{"id":"CVE-2026-25227","summary":"authentik affected by Remote Code Execution via Context Key Injection in PropertyMapping Test Endpoint","details":"authentik is an open-source identity provider. From 2021.3.1 to before 2025.8.6, 2025.10.4, and 2025.12.4, when using delegated permissions, a User that has the permission Can view * Property Mapping or Can view Expression Policy is able to execute arbitrary code within the authentik server container through the test endpoint, which is intended to preview how a property mapping/policy works. authentik 2025.8.6, 2025.10.4, and 2025.12.4 fix this issue.","aliases":["BIT-authentik-2026-25227","GHSA-qvxx-mfm6-626f"],"modified":"2026-08-12T03:51:48.985901881Z","published":"2026-02-12T19:25:26.932Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-94"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25227.json"},"references":[{"type":"WEB","url":"https://github.com/goauthentik/authentik/releases/tag/version%2F2025.10.4"},{"type":"WEB","url":"https://github.com/goauthentik/authentik/releases/tag/version%2F2025.12.4"},{"type":"WEB","url":"https://github.com/goauthentik/authentik/releases/tag/version%2F2025.8.6"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25227.json"},{"type":"ADVISORY","url":"https://github.com/goauthentik/authentik/security/advisories/GHSA-qvxx-mfm6-626f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25227"},{"type":"FIX","url":"https://github.com/goauthentik/authentik/commit/c691afaef164cf73c10a26a944ef2f11dbb1ac80"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/goauthentik/authentik","events":[{"introduced":"32e5ebb8a36833b623582a424943d8f78b34d2d2"},{"fixed":"bce6ba2afa6e021cfb5a8aa6c0e25d97fb7cf254"},{"introduced":"f2805b9b8ab423f35d6b2276e72b77594e5fb681"},{"fixed":"7b0f19465b64905b49357e10dc15abffec3737d0"},{"introduced":"56ba055857e210071519388e8a54092641b3a08d"},{"fixed":"19ad8d3ae3f266ec1096bc4461fdf6bcda1aa079"},{"fixed":"c691afaef164cf73c10a26a944ef2f11dbb1ac80"}],"database_specific":{"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"2021.3.1"},{"fixed":"2025.8.6"},{"introduced":"2025.10.0"},{"fixed":"2025.10.4"},{"introduced":"2025.12.0"},{"fixed":"2025.12.4"}]}}],"versions":["version/2025.8.5","version/2025.12.3","version/2025.12.2","version/2025.12.1","version/2025.12.0","version/2025.10.3","version/2025.10.2","version/2025.10.1","version/2025.10.0","version/2025.8.4","version/2025.8.3","version/2025.8.2","version/2025.8.1","version/2025.8.0","version/2025.8.0-rc7","version/2025.8.0-rc6","version/2025.8.0-rc5","version/2025.8.0-rc4","version/2025.8.0-rc3","version/2025.8.0-rc2","version/2025.8.0-rc1","version/2023.10.0","version/2023.8.2","version/2023.8.1","version/2023.8.0","version/2023.6.0","version/2023.5.1","version/2023.2.1","version/2022.12.1","version/2022.12.0","version/2022.10.1","version/2022.9.0","version/2022.8.2","version/2022.8.1","version/2022.7.2","version/2022.6.2","version/2022.5.2","version/2022.5.1","version/2022.4.1","version/2022.3.3","version/2022.2.1","version/2022.1.4","version/2022.1.3","version/2022.1.1","version/2021.12.5","version/2021.12.4","version/2021.12.3","version/2021.12.2","version/2021.12.1","version/2021.12.1-rc5","version/2021.12.1-rc4","version/2021.12.1-rc3","version/2021.12.1-rc2","version/2021.12.1-rc1","version/2021.10.4","version/2021.10.3","version/2021.10.1-rc3","version/2021.9.3","version/2021.9.2","version/2021.9.1","version/2021.9.1-rc3","version/2021.9.1-rc2","version/2021.9.1-rc1","version/2021.8.4","version/2021.8.3","version/2021.8.2","version/2021.8.1","version/2021.8.1-rc2","version/2021.7.1","version/2021.7.1-rc1","version/2021.6.4","version/2021.6.3","version/2021.6.1","version/2021.6.1-rc4","version/2021.6.1-rc3","version/2021.6.1-rc2","version/2021.6.1-rc1","version/2021.5.2","version/2021.5.1","version/2021.5.1-rc10","version/2021.5.1-rc9","version/2021.5.1-rc8","version/2021.4.1","version/2021.4.1-rc2","version/2021.4.1-rc1","version/2021.3.4","version/2021.3.3","version/2021.3.2","version/2021.3.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25227.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"}]}