CVE-2026-72534

This CVE exposes a feature interaction failure rather than a straightforward code defect. The SCIM token scoping mechanism and the 'adopt existing group by name' convenience feature were built by different teams at different times, each operating in their own threat model. Scoping was designed to restrict what a token could touch; group adoption was designed to reduce admin friction by matching incoming SCIM groups to existing IdP groups. Neither component modeled the security implications of their interaction when an attacker controls the group name. The underlying design problem is that group identity is treated as a mutable string rather than an immutable (scope, name) tuple. When the ingest function matches 'Administrators' without checking whether the requesting token's scope permits modifying that group, the scope boundary collapses entirely. The scope existed as a conceptual safeguard in one subsystem's design document while the group adoption feature operated in another subsystem's model of 'matching is just string comparison.' For practitioners: verify that scope validation exists at every group mutation point in your identity system, regardless of how the group reference arrives—whether by ID, name, or any convenience matching. Treat any feature that matches identity by string name as security-relevant and subject it to explicit threat modeling. The lesson is that incremental feature addition erodes security assumptions that were never formally codified as invariants at the data layer.

Reviewed through automated stages and approved by a human before publication.