CVE-2024-37905CWE-284CWE-863

Improper Access Control and Incorrect Authorization in github.com/goauthentik/authentik

High · published June 28, 2024

CVSS v3.1
8.8
EPSS
1%
Percentile
54.7
In the wild
Unconfirmed
What it is

authentik is an open-source Identity Provider that emphasizes flexibility and versatility. Authentik API-Access-Token mechanism can be exploited to gain admin user privileges. A successful exploit of the issue will result in a user gaining full admin access to the Authentik application, including resetting user passwords and more. This issue has been patched in version(s) 2024.2.4, 2024.4.2 and 2024.6.0.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00757 · 54.7th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-863 · Incorrect Authorization
Published
2024-06-28T17:09Z
EPSS history
Timeline
  • 28 JUN 17:09Z
    Improper Access Control and Incorrect Authorization in github.com/goauthentik/authentik
    cvelistv5