What is the CVSS score of EUVD-2026-77444?

EUVD-2026-77444 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Apache are affected by EUVD-2026-77444?

We need answer JSON only. Need analyze CVE. Need follow all fields. Let's parse input carefully. CVE-2026-77181: Incorrect Authorization vulnerability in Apache Syncope.

Apache EUVD-2026-77444

| CVE-2026-77181 CRITICAL

Incorrect Authorization (CWE-863)

2026-09-14 security@apache.org

GHSA-xggf-jv35-5g43

Authentication Bypass Apache

9.8

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (apache) · only source for this CVE.

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Sep 15, 2026 - 10:39 vuln.today

CVSS changed

Sep 14, 2026 - 20:22 NVD

9.8 (None) 9.8 (CRITICAL)

CVE Published

Sep 14, 2026 - 13:18 cve.org

CRITICAL 9.8

CVE Published

Sep 14, 2026 - 13:18 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Incorrect Authorization vulnerability in Apache Syncope.

An administrator with ClientApp's update entitlement is unable to perform the related operation, while ClientApp's create entitlement is checked both for create and update operations on ClientApp.

This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2.

Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.