EUVD-2026-115151
GHSA-4mxc-3jg8-grfh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as non-admin Syncope user
-
ExploitSelf-update own AuthProfile
-
ExecutionEnable impersonation for WA surrogate auth
-
ImpactAuthenticate as targeted user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated non-admin Syncope account that is permitted to perform AuthProfile self-updates, plus a deployment using WA (Web Access) surrogate authentication where impersonation can be configured. Limiting factors: exploitation is not possible pre-authentication (a valid low-privilege account is needed), and it is contingent on the WA surrogate-authentication feature being in use; affected builds are Syncope 3.0.12-3.0.16, 4.0.0-M0-4.0.8, and 4.1.0-M0-4.1.3. The specific configuration/trigger beyond self-service AuthProfile editing is not described in the available sources. |
| Impact | No CVSS vector is supplied in the input (CVSS Score: N/A), so severity signals must be inferred from the description and CWE-269 (Improper Privilege Management). The flaw lets a non-admin, authenticated Apache Syncope user perform AuthProfile self-updates that configure impersonation for WA (Web Access) surrogate authentication - a privilege-escalation-to-impersonation primitive rather than a remote pre-auth bug. There is no CISA KEV listing, no EPSS score provided, and no public exploit identified at time of analysis; the single reference is an Apache mailing-list advisory, not a working PoC. The vuln.today decision label is 'this_week', which indicates meaningful-but-not-emergency urgency consistent with an authenticated privilege-escalation issue reported directly by the vendor (apache). This is a genuine priority for organizations running affected Syncope versions with WA surrogate authentication, because successful exploitation undermines the identity/authentication trust boundary, but it is not a mass-exploitation 'drop everything' scenario: it requires an existing non-admin account and the relevant WA feature, and no active exploitation is claimed. The main uncertainty is impact scope - the description does not quantify how far impersonation extends - so treat the exact confidentiality/integrity blast radius as inferred, not confirmed. |
| Exploit ScenarioDerived | An attacker who already holds a low-privilege (non-admin) Syncope account self-updates their own AuthProfile to enable impersonation settings for WA surrogate authentication, then uses that surrogate/impersonation capability to authenticate as another user. No public exploit code is identified at time of analysis; the trigger mechanism beyond 'AuthProfile self-updates' is not detailed in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 02, 2026
Improper privilege management in Apache Syncope 3.0.12 through 3.0.16, 4.0.0-M0 through 4.0.8 and 4.1.0-M0 through 4.1.3 allows an authenticated non-admin account that is permitted to perform AuthProfile self-updates to configure impersonation used by WA (Web Access) surrogate authentication, effectively letting a low-privileged user act as another identity. Our assessment scores this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - network-reachable, authenticated (PR:L), no user interaction, with high confidentiality and integrity impact and no availability impact - because the flaw grants an authorization bypass rather than code execution. Exploitation requires a valid low-privilege account plus a deployment that actually uses WA surrogate authentication; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so priority is scheduled patching (this_week) rather than emergency response.
RemediationAI
Vendor-released patch: upgrade to Apache Syncope 4.0.9 (for the 4.0.0-M0 through 4.0.8 line) or 4.1.4 (for the 4.1.0-M0 through 4.1.3 line), as directed in the advisory at https://lists.apache.org/thread.html/25vbq0pvj8svk8gl8pjld1j0nzrdxy26; no fixed build is listed for the 3.0.12 through 3.0.16 branch, so 3.0.x installations must move to 4.0.9 or 4.1.4. If the upgrade must be staged, reduce exposure by removing the AuthProfile self-update entitlement from non-administrative roles and doing profile changes through administrators instead - the trade-off is loss of user self-service for those attributes - and, where surrogate access is not business-critical, disable WA surrogate authentication and impersonation configuration so the vulnerable settings cannot be set at all, at the cost of that delegated-access capability; also review existing AuthProfile records for unexpected impersonation entries before and after the change. Apply the update on the this_week priority indicated by the decision signal, since no public exploit code has been identified but the precondition (a valid low-privilege account) is easy to obtain in most deployments.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Syncope is the Apache Software Foundation's open-source identity and access management platform, used to provision identities, manage entitlements and drive authentication/authorization for downstream applications. The flaw is classified CWE-269 (Improper Privilege Management): the self-service AuthProfile update path does not adequately restrict which attributes a non-administrative user may change, so security-sensitive impersonation settings tied to WA (Web Access) surrogate authentication can be written by the low-privileged account itself. In practice this means a privilege boundary that should be enforced server-side on the profile-update endpoint is absent or insufficient, allowing the user to escalate from their own identity to another principal's context. The affected CPE (cpe:2.3:a:apache_software_foundation:apache_syncope) covers the whole product rather than a single component, so exposure is determined by version plus whether the WA surrogate-authentication feature and self-service AuthProfile editing are both enabled. The precise configuration and trigger sequence beyond self-service AuthProfile editing is not described in the available sources, and no CVSS vector was supplied in the raw CVE record - the severity above reflects our own assessment.
Know when Apache Syncope gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Authenticated non-admin account required so PR:L; network-facing web app with no user interaction gives AV:N/UI:N; impersonation yields high confidentiality and integrity impact, no availability effect.
Primary rating from Vendor (apache).
DescriptionCVE.org
Improper Privilege Management vulnerability in Apache Syncope.
AuthProfile self-updates allow non-admin users to configure impersonation for WA surrogate authentication. This issue affects Apache Syncope: from 3.0.12 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3.
Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.
Executive ViewAI
Apache Syncope, an identity management platform, contains a privilege escalation flaw (CVE-2026-110535) allowing any authenticated non-admin user with self-update permissions to impersonate other identities via the WA surrogate authentication feature. This directly undermines access controls, enabling unauthorized access to sensitive data and actions as another user, which could lead to data breaches or fraudulent transactions. Leadership should prioritize remediation as the vulnerability affects confidentiality and integrity across the user base, though no active exploitation has been observed.
No vendor-released patch identified at time of analysis. Interim mitigations: disable WA surrogate authentication if not needed, and restrict AuthProfile self-update permissions to trusted users only.
Threat Intelligence Overview
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Apache Syncope
View allSQL injection in Apache Syncope allows an administrator holding sufficient entitlements to execute arbitrary SQL through
Privilege escalation in Apache Syncope's identity-management engine lets a self-service user grant themselves defined Ro
SQL injection in Apache Syncope's Task search endpoint allows an authenticated administrator to execute arbitrary SQL th
Server-Side Request Forgery in Apache Syncope lets a low-privileged authenticated user abuse the Connectors and Resource
Incorrect authorization in Apache Syncope's delegated administration module allows an authenticated delegated administra
OIDC client secret exposure in Apache Syncope enables any authenticated user to retrieve complete OIDC provider configur
Sensitive AES key material is written in plaintext to Apache Syncope application logs under a specific misconfiguration
CSV formula injection in Apache Syncope allows authenticated low-privilege users to embed spreadsheet formula payloads i
Code execution via Groovy sandbox bypass in Apache Syncope 3.0 through 3.0.16, 4.0 through 4.0.5, and 4.1.0 allows a hig
Remote code execution in Apache Syncope's connector subsystem allows an administrator holding sufficient entitlements to
Remote code execution in Apache Syncope's workflow engine lets an administrator holding sufficient entitlements run arbi
Groovy sandbox escape in Apache Syncope's Implementations feature lets an administrator holding Implementation entitleme
Exploit-DB