Loading...
Skip to main content
GeekWala

CVE-2024-42490 — Vulnerability in goauthentik.io — CVE Details

CRITICAL

GoAuthentik vulnerable to Insufficient Authorization for several API endpoints

Published August 22, 2024Updated April 17, 2026Source: osv

Summary

### Summary Several API endpoints can be accessed by users without correct authentication/authorization. The main API endpoints affected by this: - `/api/v3/crypto/certificatekeypairs/<uuid>/view_certificate/` - `/api/v3/crypto/certificatekeypairs/<uuid>/view_private_key/` - `/api/v3/.../used_by/` Note that all of the affected API endpoints require the knowledge of the ID of an object, which especially for certificates is not accessible to an unprivileged user. Additionally the IDs for most objects are UUIDv4, meaning they are not easily guessable/enumerable. ### Patches authentik 2024.4.4, 2024.6.4 and 2024.8.0 fix this issue. ### Workarounds Access to the API endpoints can be blocked at a Reverse-proxy/Load balancer level to prevent this issue from being exploited. ### For more information If you have any questions or comments about this advisory: - Email us at [security@goauthentik.io](mailto:security@goauthentik.io)

Advisory Timeline

  • First published August 22, 2024 (781 days ago).
  • Last revised April 17, 2026 — 603 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Go
Update goauthentik.io to 2024.4.4 or later
go get goauthentik.io@v2024.4.4
Go
Update goauthentik.io to 2024.6.4 or later
go get goauthentik.io@v2024.6.4

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (2)

Affects 1 ecosystem: go (1).

PackageEcosystemAffectedFixed In
goauthentik.io
go
All versions2024.4.4
goauthentik.io
go
All versions2024.6.4

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-285
    Improper AuthorizationMITRE
  • CWE-863
    Incorrect AuthorizationMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.7 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
High

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:H

References

Frequently Asked Questions

What is CVE-2024-42490?
GoAuthentik vulnerable to Insufficient Authorization for several API endpoints This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 8.7/10).
How do I check if my project is affected by CVE-2024-42490?
CVE-2024-42490 affects goauthentik.io. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2024-42490 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
8.7

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-qxqc-27pr-wgc8
BIT-authentik-2024-42490
GO-2024-3085

Related CVEs

  • CVE-2026-107806
    CRITICAL

    Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

  • CVE-2026-68582
    CRITICAL

    Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)

  • CVE-2025-53942
    HIGH

    Authentik has insufficient check for account active status when authenticating with OAuth/SAML Sources

  • CVE-2026-47201
    HIGH

    authentik's XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated user

More Go Modules advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies