Summary
Due to insufficient permission checks it was possible for any authenticated user to elevate their permissions to a superuser by creating an API token and changing the user the token belonged to.
Patches
authentik 2024.6.0, 2024.4.3 and 2024.2.4 fix this issue, for other versions the workaround can be used.
Details
By setting a token's user ID to the ID of a higher privileged user, the token will inherit the higher privileged access to the API. This can be used to change the password of the affected user or to modify the authentik configuration in a potentially malicious way.
Workarounds
As a workaround it is possible to block any requests to /api/v3/core/tokens* at the reverse-proxy/load-balancer level. Doing so prevents this issue from being exploted.
For more information
If you have any questions or comments about this advisory:
m2a2 Reporter
Summary
Due to insufficient permission checks it was possible for any authenticated user to elevate their permissions to a superuser by creating an API token and changing the user the token belonged to.
Patches
authentik 2024.6.0, 2024.4.3 and 2024.2.4 fix this issue, for other versions the workaround can be used.
Details
By setting a token's user ID to the ID of a higher privileged user, the token will inherit the higher privileged access to the API. This can be used to change the password of the affected user or to modify the authentik configuration in a potentially malicious way.
Workarounds
As a workaround it is possible to block any requests to
/api/v3/core/tokens*at the reverse-proxy/load-balancer level. Doing so prevents this issue from being exploted.For more information
If you have any questions or comments about this advisory: