Your authentik 'Helpdesk' Admin Might Be Superuser: CVE-2026-40172 (Not KEV, But Patch It)

The short version//

This one is a sidebar, not a headline — and I'm going to be honest about the difference. CVE-2026-40172 is a May 2026 privilege-escalation flaw in authentik, the popular self-hosted identity provider a lot of homelabs run as their SSO front door. It's not on the current KEV list, NVD hasn't prioritized it, and there's no confirmed in-the-wild exploitation. So if you only patch what's on fire, you can skip this. But if you run authentik with delegated admins — the kind of "helpdesk" role that lets someone manage users without making them superuser — this one's for you, and it's a ten-minute check.

The flaw, in one breath//

The idea behind a delegated admin role is least privilege: give the helpdesk person the power to manage users (reset a password, add a group) without giving them admin power. The bug is that the boundary between those two didn't hold:

• A delegated user manager can hit PATCH /api/v3/core/users/{pk}/ and assign arbitrary groups to a user.
• Among the assignable groups is one that sets is_superuser=True.
• Assign that group to yourself (or to a user you can control) and you've just promoted a helpdesk account to admin-equivalent.

So the "least privilege" role has a back door into full admin. In privilege-escalation terms, it's a clean one: a low-priv identity that's supposed to be contained can un-contain itself.

Why it matters to your setup//

This is the most on-audience story of the bunch in a specific way: authentik is exactly the kind of self-hosted IdP this zine's readers run, and the "delegated helpdesk admin" role is exactly the kind of thing a homelabber or a small team sets up so they don't hand everyone superuser. If you've got:

• an authentik instance fronting your apps,
• at least one delegated/non-superuser admin (a helpdesk, a junior admin, a "trusted friend" account),
• and you haven't audited what groups that role can assign,

then you're in the blast radius. The fix ships in authentik 2025.12.5 and 2026.2.3 — check your version and upgrade if you're behind.

The honest framing//

• Not KEV, not in-the-wild-confirmed — so the tone is "patch at next convenience," not "drop everything."
• Real CVE, real mechanism — the vendor rates it High (CVSS 8.1), and it surfaced in the homelab community before the enterprise scanners did, which is how a lot of self-hosted stuff gets found.
• The lesson is about the role, not just the patch. Even after you patch, ask: can my delegated admins grant groups to themselves? That's the question this CVE answered "yes" to, and it's worth asking of any IdP where you've created an "admin-ish but not fully admin" tier.