security: fix CVE-2023-26481 (#4832)

fix CVE-2023-26481

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

website/docs/policies/expression.mdx

@@ -99,7 +99,7 @@ This includes the following:
 -   `context['application']`: The application the user is in the process of authorizing. (Optional)
 -   `context['source']`: The source the user is authenticating/enrolling with. (Optional)
 -   `context['pending_user']`: The currently pending user, see [User](../user-group/user.md#object-attributes)
--   `context['is_restored']`: Set to `True` when the flow plan has been restored from a flow token, for example the user clicked a link to a flow which was sent by an email stage. (Optional)
+-   `context['is_restored']`: Contains the flow token when the flow plan was restored from a link, for example the user clicked a link to a flow which was sent by an email stage. (Optional)
 -   `context['auth_method']`: Authentication method (this value is set by password stages) (Optional)
 
     Depending on method, `context['auth_method_args']` is also set.

website/docs/security/CVE-2023-26481.md

@@ -0,0 +1,27 @@
+# CVE-2023-26481
+
+_Reported by [@fuomag9](https://github.com/fuomag9)_
+
+## Insufficient user check in FlowTokens by Email stage
+
+### Summary
+
+Due to an insufficient access check, a recovery flow link that is created by an admin (or sent via email by an admin) can be used to set the password for any arbitrary user.
+
+### Patches
+
+authentik 2022.12.3, 2023.1.3, 2023.2.3 fix this issue.
+
+### Impact
+
+This attack is only possible if a recovery flow exists, which has both an Identification and an Email stage bound to it. If the flow has policies on the identification stage to skip it when the flow is restored (by checking `request.context['is_restored']`), the flow is not affected by this. With this flow in place, an administrator must create a recovery Link or send a recovery URL to the attacker, who can, due to the improper validation of the token create, set the password for any account.
+
+### Workaround
+
+It is recommended to upgrade to the patched version of authentik. Regardless, for custom recovery flows it is recommended to add a policy that checks if the flow is restored, and skips the identification stage.
+
+### For more information
+
+If you have any questions or comments about this advisory:
+
+-   Email us at [security@goauthentik.io](mailto:security@goauthentik.io)