EUVD-2026-77444
GHSA-xggf-jv35-5g43
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as entitled Syncope admin
-
DeliveryHold only ClientApp CREATE entitlement
-
ExploitInvoke ClientApp update via REST/console
-
ExecutionWrong entitlement check passes
-
ImpactModify existing ClientApp config beyond authorization
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated Apache Syncope administrator who already holds the ClientApp CREATE entitlement; that admin can then perform ClientApp UPDATE operations for which they lack the proper entitlement. The mirror-image effect is that an admin holding only the ClientApp UPDATE entitlement is wrongly blocked from updating. Exploitation is limited to the trusted admin/delegated-administration population - there is no unauthenticated or anonymous path - and only affects ClientApp objects on Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. It is neutralized by upgrading to 4.0.8 or 4.1.3. |
| Impact | This is a textbook example of an inflated CVSS score. The published CVSS 3.1 vector (9.8, AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is contradicted by the vulnerability class and description: CWE-863 (Incorrect Authorization) here is an entitlement-check mismatch reachable only by an authenticated Syncope administrator who already holds a ClientApp entitlement, so PR:N (unauthenticated) is wrong - it should be PR:L at minimum. The C:H/I:H/A:H triad is also overstated: the flaw lets an admin with only the ClientApp CREATE entitlement perform UPDATE operations (a limited integrity/over-permission issue), and conversely denies UPDATE to admins who legitimately hold the UPDATE entitlement (a functional breakage). There is no data disclosure and no availability impact, so C:N/A:N and only limited I. Corroborating signals point to low real-world risk: EPSS is 0.48% (40th percentile), there is no CISA KEV listing and no public POC, and SSVC records Exploitation: none. The SSVC 'Automatable: yes / Technical Impact: total' entries lean on the same overstated CVSS impact and should be discounted given that exploitation requires an existing privileged admin account. Net: high nominal CVSS but low genuine priority - a privilege-boundary correctness bug within an already-trusted admin population, not a remote-unauthenticated compromise. |
| Exploit ScenarioDerived | An organization delegates Apache Syncope administration and grants a junior/limited admin only the ClientApp CREATE entitlement, intending to let them register new client applications but not modify existing ones. Because the code checks the CREATE entitlement for both create and update, that admin can also modify (update) existing ClientApp definitions, exceeding their intended authorization. No public exploit code exists and this requires a valid, entitled admin session, so it is an insider/over-delegation risk rather than a remote attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Incorrect authorization in Apache Syncope allows a delegated administrator who holds only the ClientApp CREATE entitlement to also carry out ClientApp UPDATE operations, with the mirror-image defect wrongly blocking an administrator who legitimately holds the ClientApp UPDATE entitlement - an integrity-only flaw confined to the trusted, authenticated administrative population rather than an anonymous attack path. The flaw affects Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2, and is neutralized by upgrading to 4.0.8 or 4.1.3. There is no public exploit identified at time of analysis, EPSS is low at 0.48% (40th percentile), and CISA's SSVC records Exploitation as 'none' (though Automatable as 'yes'); the NVD-assigned CVSS of 9.8 with PR:N is substantially overstated relative to the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, which reflects an authenticated admin prerequisite and low integrity-only impact.
RemediationAI
Vendor-released patch: upgrade to Apache Syncope 4.0.8 or 4.1.3, the versions named in the advisory; no fixed 3.0.x release is identified in the supplied data, so deployments on the 3.0.0-M0-3.0.16 line should plan a migration to the patched 4.x branch. Before patching, audit delegated-administration roles for ClientApp entitlements and remove the ClientApp CREATE entitlement from any role that is not intended to modify ClientApp objects - the trade-off is that those administrators also lose legitimate create capability, because the same CREATE check governs the create path, and removing UPDATE from UPDATE-only holders accomplishes nothing until the upgrade lands. Restrict administrative and delegated-admin access to trusted operators and alert on ClientApp modification events performed by principals whose role set lacks the UPDATE entitlement, since such events are the observable signature of exploitation; this is detective rather than preventive and will not stop a determined insider. Because the assessed vector is integrity-only with no confidentiality or availability impact, no network-level blocking, port filtering, or WAF rule is an effective compensating control here; the practical mitigation is entitlement hygiene plus the upgrade, with advisory URLs above for patch verification. The full advisory set is at https://lists.apache.org/thread/swqj31jhbz7hmmkjy42461zp9rhh9lwy and https://seclists.org/oss-sec/2026/q3/766.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Root cause is CWE-863 (Incorrect Authorization): Apache Syncope, a Java-based identity governance and access management (IAM) platform, implements delegated administration through fine-grained 'entitlements' that are attached to roles and checked per entity type and operation. In the affected releases the authorization interceptor for the ClientApp entity type consults the CREATE entitlement when an UPDATE operation is submitted, so the two entitlements are not evaluated against their matching operations - an administrator with CREATE gains UPDATE capability they were never granted, while an administrator granted only UPDATE is rejected. Because the defect is a mapping error in an authorization decision rather than a memory-safety, injection, or deserialization flaw, the consequences are bounded to unauthorized modification of ClientApp objects inside Syncope; there is no code execution, data disclosure, or availability component, and no unauthenticated path exists since every affected operation is reached through an already-authenticated administrative session. The affected component is the Syncope core/delegated-administration authorization layer rather than a specific library or protocol; the advisory is attributed to the Apache Syncope security team and was published through the Apache mailing-list thread and oss-security, with a parallel EUVD entry (EUVD-2026-77444) mirroring the same version ranges. Note that the supplied intelligence did not include CPE identifiers, so affectedness must be determined from the stated version ranges rather than automated CPE matching.
Know when Syncope gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Requires an authenticated admin with a ClientApp entitlement (PR:L); impact is limited unauthorized modification of ClientApp config (I:L), with no disclosure (C:N) or availability loss (A:N).
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
3DescriptionCVE.org
Incorrect Authorization vulnerability in Apache Syncope.
An administrator with ClientApp's update entitlement is unable to perform the related operation, while ClientApp's create entitlement is checked both for create and update operations on ClientApp.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2.
Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
Executive ViewAI
Apache Syncope contains an authorization flaw that lets delegated administrators with only ClientApp CREATE rights also perform UPDATE actions, while blocking legitimate UPDATE holders, affecting versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. The issue is confined to authenticated administrative users and has integrity-only impact, with no public exploit identified at time of analysis. Leadership should prioritize access-control review and upgrade to 4.0.8 or 4.1.3 because the flaw weakens segregation of duties in identity governance.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and un
Missing authorization in Apache Syncope (3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2) le
Cross-realm authorization bypass in Apache Syncope allows an administrator who already holds delegated entitlements in o
Incorrect authorization in Apache Syncope (3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2)
Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1
A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary
An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupporte
Apache Syncope can be configured to store the user password values in the internal database with AES encryption, though
Apache Syncope's pluggable extension mechanism lets a user holding administrator rights supply custom interface implemen
In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow
An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not li
Stacked SQL injection in Apache Syncope (3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2) al
Exploit-DB