# authentik version/2024.10.3 — Release & Upgrade Intelligence
- **Product:** authentik (https://goauthentik.io)
- **Version:** version/2024.10.3
- **Released:** Nov 21, 2024
- **Impact Score:** 5/10
- **Breaking Changes:** Not verified
- **Canonical Analysis:** https://changelogs.us/authentik/updates/version-2024.10.3/

## Executive Summary (TL;DR)
authentik version/2024.10.3. Source highlight: See https://docs.goauthentik.io/docs/releases/2024.10#fixed-in-2024103

## New Features
- internal: add CSP header to files in `/media` (cherry-pick #12092)
- website/docs: add CSP to hardening (cherry-pick #11970)

## Bug Fixes
- providers/ldap: fix global search_full_directory permission not being sufficient (cherry-pick #12028)
- rbac: fix incorrect object_description for object-level permissions (cherry-pick #12029)
- web/flows: fix invisible captcha call (cherry-pick #12048)
- core: fix source_flow_manager throwing error when authenticated user attempts to re-authenticate with existing link (cherry-pick #12080)
- root: fix activation of locale not being scoped (cherry-pick #12091)
- security: fix CVE 2024 52287 (cherry-pick #12114)