EUVD-2026-77460
GHSA-2rr8-vg3r-2q9m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as admin with task-execution entitlement
-
DeliveryInvoke group (de)provisioning task
-
ExploitMissing group-capability authorization check
-
ExecutionMass add/remove members of out-of-scope groups
-
ImpactAlter identity/entitlement state
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated Apache Syncope administrator account that holds task-execution entitlements. The flaw is that this administrator can mass (de)provision group members even for groups over which they lack group-related administration capabilities - i.e., the authorization check tying task execution to group-scoped admin rights is missing. Exploitation is therefore limited to insiders or compromised admin accounts already granted task-execution rights; it is NOT reachable by unauthenticated or unprivileged users despite the PR:N in the published vector. Impact is confined to provisioning/de-provisioning group membership state (integrity of identity data). |
| Impact | The headline CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) substantially overstates real-world risk and is internally inconsistent with the description. The description explicitly requires 'an administrator with task execution entitlements' - an authenticated, privileged actor - which contradicts the PR:N (no privileges) in the vector; this should be PR:H, not PR:N. The impact is also mischaracterized: mass (de)provisioning of group members is an integrity effect on identity/provisioning state, not the confidentiality/availability breach implied by C:H/A:H. Corroborating signals point to a low-urgency issue: EPSS is 0.58% (46th percentile), there is no CISA KEV listing, and no public exploit is identified. SSVC (Exploitation: none, Automatable: yes, Technical Impact: total) is the only elevated signal, and 'Automatable: yes / Technical Impact: total' reflect the authz-bypass primitive's power once an admin abuses it, not ease of initial access. Net: this is a genuine authorization flaw worth patching, but it is a privilege/entitlement-scoping bug exploitable only by an already-trusted administrator, not an unauthenticated internet-facing critical. Treat as medium priority, weighted by exposure of admin accounts, rather than a drop-everything 9.8. |
| Exploit ScenarioDerived | An authenticated Apache Syncope administrator who has been granted task-execution entitlements - but who was deliberately NOT given administration capabilities over certain groups - invokes a (de)provisioning task and mass-adds or mass-removes members of those groups anyway, bypassing the group-scoped authorization boundary. This lets a limited-scope admin manipulate group membership (and thus downstream resource entitlements) for groups outside their delegated authority. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Missing authorization in Apache Syncope (3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2) lets an administrator who holds task-execution entitlements mass-provision or de-provision group members even for groups the administrator is not entitled to manage, because the authorization check binding task execution to group-scoped administration rights is absent. Impact is limited to the integrity of identity/provisioning data - group membership state - rather than confidentiality or availability, and it is only reachable by an already-privileged administrative insider or a compromised admin account. The published CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) materially overstates the risk and is inconsistent with both the description and our independent assessment (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N); no public exploit code has been identified at time of analysis, EPSS is 0.58% (46th percentile), and CISA's SSVC records Exploitation: none with Automatable: yes and Technical Impact: total.
RemediationAI
Vendor-released patches are available: upgrade Apache Syncope to 4.1.3 or 4.0.8 (matching your release line), per the Apache advisory at https://lists.apache.org/thread/94rx818lj8sjx85h8pory9xcsst9xvot. If upgrading cannot be done immediately, the effective compensating control is to narrow the privilege surface: audit every administrator role that carries the task-execution entitlement and remove it from any account that is not also trusted with full group administration, accepting the operational side effect that legitimate task automation may need to be reassigned to fewer, dedicated service accounts. Restrict access to the administrative console and REST endpoints used to create and run provisioning tasks to a management network or trusted IP allowlist, and enable audit/logging alerts on bulk group membership changes so unauthorized mass (de)provisioning is detected quickly - noting that this detection approach is detective rather than preventive and does not repair already-altered membership state. Because exploitation requires an authenticated administrator with task-execution rights, credential hygiene, MFA and prompt revocation of stale admin accounts further reduce exposure, but none of these substitutes for applying 4.0.8 or 4.1.3.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Syncope is an open-source identity and access management (IAM) and identity governance platform built around a provisioning engine that synchronizes users, groups and memberships to external resources. Its administrative model assigns entitlements/privileges to administrators - including the ability to execute provisioning tasks - and normally scopes group administration to specific groups. The flaw is CWE-862 (Missing Authorization): the task-execution code path performs the group-membership (de)provisioning operation without validating that the executing administrator also holds administration rights over the target group, so a task-execution entitlement implicitly escalates into blanket group-administration capability. The affected component is the core provisioning/task layer shared by the 3.0.x, 4.0.x and 4.1.x release lines; the CPE data supplied in this feed does not enumerate a vendor:product string, so version matching must be done against the vendor-published ranges (3.0.0-M0-3.0.16, 4.0.0-M0-4.0.7, 4.1.0-M0-4.1.2). Note that the published CVSS vector claims PR:N, whereas the underlying code path is only reachable after authenticating as an administrator with task-execution privileges, which is why the authoritative assessment uses PR:H and confines impact to integrity.
Know when Syncope gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Requires an authenticated admin with task-execution entitlements (PR:H); network-reachable admin console (AV:N/AC:L); impact is integrity of provisioning state (I:H), no data disclosure or availability loss (C:N/A:N).
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
3DescriptionCVE.org
Missing Authorization vulnerability in Apache Syncope.
An administrator with task execution entitlements might be able to mass (de)provision group members, regardless of their group-related administration capabilities.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2.
Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
Executive ViewAI
Apache Syncope identity governance deployments (versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2) contain a missing authorization check that would let an administrator with task-execution entitlements alter group membership for groups they are not authorized to manage, and no vendor patch is available. The exposure is limited to the integrity of identity and provisioning records rather than confidentiality or availability, and it is reachable only by an already-privileged insider or a compromised administrator account, so the published 9.8 score overstates the practical risk. This matters to leadership because Syncope is often the system of record for downstream access entitlements, so unauthorized membership changes could silently grant or revoke access across connected applications until detected.
No vendor-released patch identified at time of analysis; interim mitigations are to restrict task-execution entitlements to the minimum necessary administrators, enforce least privilege and MFA on all administrative accounts, monitor and alert on bulk or out-of-scope group membership changes, and regularly review identity provisioning audit logs for unauthorized modifications.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and un
Incorrect authorization in Apache Syncope allows a delegated administrator who holds only the ClientApp CREATE entitleme
Cross-realm authorization bypass in Apache Syncope allows an administrator who already holds delegated entitlements in o
Incorrect authorization in Apache Syncope (3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2)
Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1
A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary
An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupporte
Apache Syncope can be configured to store the user password values in the internal database with AES encryption, though
Apache Syncope's pluggable extension mechanism lets a user holding administrator rights supply custom interface implemen
In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow
An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not li
Stacked SQL injection in Apache Syncope (3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2) al
Exploit-DB