| Summary | authentik is an open-source Identity Provider. Several API endpoints can be accessed by users without correct authentication/authorization. The main API endpoints affected by this are /api/v3/crypto/certificatekeypairs/<uuid>/view_certificate/, /api/v3/crypto/certificatekeypairs/<uuid>/view_private_key/, and /api/v3/.../used_by/. Note that all of the affected API endpoints require the knowledge of the ID of an object, which especially for certificates is not accessible to an unprivileged user. Additionally the IDs for most objects are UUIDv4, meaning they are not easily guessable/enumerable. authentik 2024.4.4, 2024.6.4 and 2024.8.0 fix this issue. |
|---|---|
| Publication Date | Aug. 23, 2024, 1:15 a.m. |
| Registration Date | Aug. 26, 2024, 4:57 p.m. |
| Last Update | Aug. 24, 2024, 1:18 a.m. |
| Title | Authentik Security Inc の authentik における認可に関する脆弱性 |
|---|---|
| Summary | Authentik Security Inc の authentik には、認可に関する脆弱性が存在します。 |
| Possible impacts | 情報を取得される、および情報を改ざんされる可能性があります。 |
| Solution | ベンダアドバイザリまたはパッチ情報が公開されています。参考情報を参照して適切な対策を実施してください。 |
| Publication Date | Aug. 22, 2024, midnight |
| Registration Date | Aug. 22, 2025, 11:44 a.m. |
| Last Update | Aug. 22, 2025, 11:44 a.m. |
| Authentik Security Inc |
| authentik 2024.4.4 未満 |
| authentik 2024.6.0 以上 2024.6.4 未満 |
| No | Changed Details | Date of change |
|---|---|---|
| 1 | [2025年08月22日] 掲載 |
Aug. 22, 2025, 11:44 a.m. |