Apache Syncope CVE-2026-73370

Requires an authenticated Syncope administrator account that is subject to delegated administration but lacks the specific entitlements for the targeted objects/realms - the vulnerability is that the Reconciliation service's pull and push operations do not fully enforce those entitlements. Exploitation is therefore limited to environments that (a) grant administrator/delegated-admin accounts to more than a single fully-trusted operator and (b) expose the Syncope core REST reconciliation endpoints to those accounts; it is network-reachable and low-complexity but is NOT unauthenticated despite the published PR:N. A single-admin deployment or one that does not use delegated administration has little practical exposure.

The published CVSS 9.8 (AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H) overstates real-world risk: the description explicitly frames the actor as an 'administrator not provided with adequate entitlements,' which means an authenticated admin account is a precondition, so PR:N is almost certainly wrong and PR:L is more accurate - this is a horizontal/vertical privilege escalation among administrators, not an unauthenticated compromise. SSVC data reinforces a nuanced picture: Exploitation is 'none' (no observed or public exploit) but Automatable is 'yes' and Technical Impact is 'total,' so a malicious or over-scoped delegated admin who reaches these endpoints could fully manipulate identity data at scale. EPSS and a KEV entry are not present in the input, and no POC is referenced, so this is a high-severity-on-paper issue whose realistic priority hinges on how many delegated administrators exist in a deployment and how much they are trusted; environments that lean heavily on delegated administration to segment duties should still treat it as urgent, since the whole point of that model - containing what a partial admin can do - is what breaks here. Because reconciliation can rewrite identities across connected systems, even a mid-sized operator running Syncope for workforce provisioning should prioritize patching over waiting for exploit evidence.

An organization uses Syncope's delegated administration to give a team-level administrator limited rights over one realm. That administrator crafts REST calls to the Reconciliation service's push or pull endpoints targeting objects or resources outside their entitlement scope; because the delegated-admin check is incomplete, the server executes the operation, letting them read or overwrite identities on connected systems they should never control. No public exploit is identified at time of analysis, but the operation is automatable and requires only low complexity once authenticated.