EUVD-2026-77438
GHSA-w7wp-qc67-vgc8
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Privilege assignment review
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 15, 2026
Privilege escalation in Apache Syncope's internal JWT authentication (CWE-266) lets a low-privileged authenticated user obtain full administrator rights when the JWKS settings used to sign internal JWTs are disclosed. It affects Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2, and is fixed in 4.0.8 and 4.1.3. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as none, though the flaw is assessed as automatable with total technical impact.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Apache Syncope gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (apache) · only source for this CVE.
CVSS VectorVendor: apache
Lifecycle Timeline
3DescriptionCVE.org
Incorrect privilege assignment vulnerability in Apache Syncope.
When the configured JWKS settings for internal JWT authentication are disclosed (at least protocol and key), an attacker can obtain admin privileges after completing a successful authentication and obtaining a valid low-privileges JWT.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2.
Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
Executive ViewAI
Apache Syncope versions 3.0.0 through 4.1.2 contain a critical privilege escalation vulnerability in JWT authentication that enables low-privileged authenticated users to obtain full administrator rights when JWKS signing keys are exposed. Organizations deploying Syncope as their central identity and access management platform face complete compromise of authentication controls and authorization decisions across connected systems.
Within 24 hours, inventory all Apache Syncope deployments and identify which are running vulnerable versions (3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, 4.1.0-M0 through 4.1.2); verify the security posture of JWKS configuration and review authentication logs for unauthorized admin privilege grants. Within 7 days, deploy vendor-released patches: upgrade 4.0.x track to version 4.0.8 or later and 4.1.x track to version 4.1.3 or later; for 3.0.x instances with no available patch, initiate migration planning to supported branches. Within 30 days, complete all upgrades across production environments and validate JWT authentication flows function correctly post-deployment.
Vendor-released patch available: Syncope 4.0.8 and 4.1.3. Apply these patches immediately for 4.0.x and 4.1.x deployments. For 3.0.x with no available patch: restrict administrative access to JWKS configuration endpoints, encrypt JWKS signing keys at rest, limit API-level access to JWKS retrieval, implement enhanced monitoring for unauthorized privilege escalation patterns, and prioritize migration to patched versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Apache Syncope
View allSQL injection in Apache Syncope allows an administrator holding sufficient entitlements to execute arbitrary SQL through
Privilege escalation in Apache Syncope's identity-management engine lets a self-service user grant themselves defined Ro
SQL injection in Apache Syncope's Task search endpoint allows an authenticated administrator to execute arbitrary SQL th
Server-Side Request Forgery in Apache Syncope lets a low-privileged authenticated user abuse the Connectors and Resource
Incorrect authorization in Apache Syncope's delegated administration module allows an authenticated delegated administra
OIDC client secret exposure in Apache Syncope enables any authenticated user to retrieve complete OIDC provider configur
Sensitive AES key material is written in plaintext to Apache Syncope application logs under a specific misconfiguration
CSV formula injection in Apache Syncope allows authenticated low-privilege users to embed spreadsheet formula payloads i
Code execution via Groovy sandbox bypass in Apache Syncope 3.0 through 3.0.16, 4.0 through 4.0.5, and 4.1.0 allows a hig
Remote code execution in Apache Syncope's connector subsystem allows an administrator holding sufficient entitlements to
Remote code execution in Apache Syncope's workflow engine lets an administrator holding sufficient entitlements run arbi
Groovy sandbox escape in Apache Syncope's Implementations feature lets an administrator holding Implementation entitleme
Exploit-DB