Files

Teffen Ellis 582812b3ec website: Flesh out docs split.

website: Copy files during build.

website: Allow for mixed env builds.

website: Reduce build size.

website: Expose build.

website: Add build memory debugging.

WIP: Disable broken links check to compare memory usage.

website: Update deps.

website: Clean up API paths.

website: Flesh out 3.8 fixes.

Format.

website: Update ignore paths.

Website: Clean up integrations build.

website: Fix paths.

website: Optimize remark.

website: Update deps.

website: Format.

website: Remove linking.

website: Fix paths.

wip: Attempt API only build.

Prep.

Migrate render to runtime. Tidy sidebar.

Clean up templates.

docs: Move directory. WIP

docs: Flesh out split.

website: Fix issue where routes have collisions.

2025-07-01 21:53:19 +02:00

1.0 KiB

Raw Blame History

CVE-2024-37905

Reported by @m2a2

Improper Authorization for Token modification

Summary

Due to insufficient permission checks it was possible for any authenticated user to elevate their permissions to a superuser by creating an API token and changing the user the token belonged to.

Patches

authentik 2024.6.0, 2024.4.3 and 2024.2.4 fix this issue, for other versions the workaround can be used.

Details

By setting a token's user ID to the ID of a higher privileged user, the token will inherit the higher privileged access to the API. This can be used to change the password of the affected user or to modify the authentik configuration in a potentially malicious way.

Workarounds

As a workaround it is possible to block any requests to /api/v3/core/tokens* at the reverse-proxy/load-balancer level. Doing so prevents this issue from being exploited.

For more information

If you have any questions or comments about this advisory:

Email us at security@goauthentik.io

1.0 KiB Raw Blame History