Apache Syncope EUVD-2026-115153

Exploitation requires the attacker to already be a delegated administrator in Apache Syncope with legitimate management authority over at least one realm; there is no unauthenticated or anonymous path. The specific abusable operation is relocating a Realm subtree across administrative realm boundaries, where Syncope fails to require permission on the destination realm. Limiting factors: the attacker must hold a valid delegated-admin account, so this is an insider/privilege-escalation condition rather than external remote compromise; only the listed versions (3.0.0-M0-3.0.16, 4.0.0-M0-4.0.8, 4.1.0-M0-4.1.3) are affected. The available evidence does not state whether non-default configuration is required, so assume default delegated-administration setups are exploitable.

No CVSS, EPSS, KEV, or SSVC data was supplied, so quantitative exploitation signals are absent and risk must be inferred from the description and CWE-639 alone. The flaw is an authorization bypass (CWE-639) exploitable only by an already-privileged insider - a delegated administrator - rather than an anonymous remote attacker, which materially lowers real-world urgency compared to a network-facing unauthenticated flaw. The vuln.today decision label is 'this_week' (not act_now or emergency), and there is no public exploit identified at time of analysis - the sole reference is the Apache advisory thread, not proof-of-concept code. There is no CISA KEV listing and no EPSS probability to indicate active or likely widespread exploitation, consistent with a privilege-boundary bug that requires legitimate delegated-admin access to trigger. The main caveat: the input provides no CVSS vector at all, so attack vector, complexity, and privilege level are my independent assessment and should be verified against the Apache advisory; treat the severity as moderate and prioritize for patching within the normal cycle rather than as an emergency.

A user who already holds delegated administrator rights over one realm issues a request to relocate a realm subtree into a destination realm for which they have no management permission; Syncope fails to enforce authorization on the destination, so the move succeeds and the delegated admin gains control over resources outside their authorized scope. This is a privileged-insider abuse rather than remote unauthenticated compromise. No public exploit code is identified - the only reference is the Apache advisory thread, not a verified working PoC.