Privilege escalation via self-service REST API in Apache Syncope (CVE-2026-62183)

An improper privilege management vulnerability in Apache Syncope allows an authenticated user to escalate their own privileges via a REST API call. Under certain workflow adapter configurations, a user can assign themselves one or more defined Roles, gaining the associated Entitlements and effectively becoming an administrator. The scope of privilege gain depends on the Roles defined in the specific deployment. Affected versions: - 3.0.0-M0 through 3.0.16 - 4.0.0-M0 through 4.0.6 - 4.1.0-M0 through 4.1.1 We recommend updating to: 4.0.7, 4.1.2. CVSS ? · our assessment: this_week Reference: https://lists.apache.org/thread/6r8cngvy43y2yk4jj3w060dt8vx0yzpr Details: https://vuln.today/cve/CVE-2026-62183