EUVD-2026-77474
GHSA-82x7-r2q8-xr3h
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Requires authenticated delegated admin access (PR:L) and sibling Realms with overlapping name prefixes as a deployment condition (AC:H); confidentiality impact is partial since unauthorized Realm access enables both read and administrative write.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
4DescriptionCVE.org
Incorrect Authorization vulnerability in Apache Syncope.
Delegated administration security checks are based on Realm hierarchy and enforced via prefix matches. Due to incorrect implementation, two sibling Realms whose names begin with the same string cannot be correctly distinguished, resulting in incorrect authorization.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2.
Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
AnalysisAI
Incorrect authorization in Apache Syncope's delegated administration module allows an authenticated delegated administrator to exercise privileges over a sibling Realm they were never granted access to, by exploiting a prefix-string matching flaw in the Realm hierarchy enforcement code. Affected releases span the entire 3.0.x (through 3.0.16), 4.0.x (through 4.0.7), and 4.1.x (through 4.1.2) branches. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) the attacker holds valid delegated administrator credentials within the target Syncope instance (authenticated, PR:L equivalent); (2) the deployment contains at least two sibling Realms - Realms that share the same parent - whose names share a common leading substring (e.g., 'hr' and 'hr-contractors'); and (3) the attacker's delegation scope is bound to the shorter-named Realm. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N) overstates real-world risk in two meaningful ways: delegated administration is inherently an authenticated function, making PR:N inconsistent with the description, and the attack requires the deployment to contain sibling Realms whose names share a leading string, which is a specific configuration condition rather than a universal default. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Apache Syncope 4.0.8 or 4.1.3, which correct the prefix-match anchoring logic in delegated administration authorization, as specified in the vendor advisory at https://lists.apache.org/thread/5m8t357n2xt38ym5l2rrgbjyztd97yjv. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Apache Syncope deployments and document affected versions (3.0.x through 4.1.2) with emphasis on those using delegated multi-tenant Realm administration. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Syncope
View allSQL injection in Apache Syncope allows an administrator holding sufficient entitlements to execute arbitrary SQL through
Privilege escalation in Apache Syncope's identity-management engine lets a self-service user grant themselves defined Ro
SQL injection in Apache Syncope's Task search endpoint allows an authenticated administrator to execute arbitrary SQL th
Server-Side Request Forgery in Apache Syncope lets a low-privileged authenticated user abuse the Connectors and Resource
OIDC client secret exposure in Apache Syncope enables any authenticated user to retrieve complete OIDC provider configur
Sensitive AES key material is written in plaintext to Apache Syncope application logs under a specific misconfiguration
CSV formula injection in Apache Syncope allows authenticated low-privilege users to embed spreadsheet formula payloads i
Code execution via Groovy sandbox bypass in Apache Syncope 3.0 through 3.0.16, 4.0 through 4.0.5, and 4.1.0 allows a hig
Remote code execution in Apache Syncope's connector subsystem allows an administrator holding sufficient entitlements to
Remote code execution in Apache Syncope's workflow engine lets an administrator holding sufficient entitlements run arbi
Groovy sandbox escape in Apache Syncope's Implementations feature lets an administrator holding Implementation entitleme
Broken delegated-administration authorization in Apache Syncope's Reconciliation service lets an authenticated administr
Same weakness CWE-863 – Incorrect Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today