https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-15T22:22:33.942782+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-25227 CVE-2026-25227 — authentik affected by Remote Code Execution via Context Key Injection in PropertyMapping Test Endpoint 2026-10-15T22:22:33.943839+00:00

Affected: goauthentik authentik

authentik is an open-source identity provider. From 2021.3.1 to before 2025.8.6, 2025.10.4, and 2025.12.4, when using delegated permissions, a User that has the permission Can view * Property Mapping or Can view Expression Policy is able to execute arbitrary code within the authentik server container through the test endpoint, which is intended to preview how a property mapping/policy works. authentik 2025.8.6, 2025.10.4, and 2025.12.4 fix this issue.