EUVD-2026-77458
GHSA-8xq5-27gf-f6pp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as delegated realm admin
-
DeliveryCall REST Connector-read endpoint for another realm
-
ExploitAuthorization scoping fails to filter
-
ExecutionReceive full config incl confidential properties
-
ImpactDuplicate connector/credentials into own realm
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated Apache Syncope administrator who already holds delegated administration entitlements in at least one Realm; the flaw lets that admin read, via the REST API, Connector configuration objects (including confidential/secret properties) scoped to a DIFFERENT Realm they should not have access to, and duplicate them into their own realm. Limiting factors: this is not remotely reachable without valid admin credentials (contradicting the vector's PR:N), it is a privilege-boundary/insider abuse rather than external unauthenticated access, no user interaction of a victim is needed, and it affects only deployments running the listed pre-fix versions with multiple realms and delegated administration in use. |
| Impact | This is a real but moderate-severity issue whose headline CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) materially overstates the danger. The description explicitly states exploitation requires 'an administrator with adequate entitlements in a given Realm' - i.e. an authenticated, privileged operator - which contradicts the PR:N in the CVSS vector; this should be at least PR:L. Impact is fundamentally cross-realm information disclosure (reading another realm's Connector configuration including confidential properties/credentials), so C:H is justified but I:H/A:H are not supported by the description, which describes no data modification of the victim realm nor availability loss. Supporting signals align with a lower priority: SSVC shows Exploitation=none (no observed exploitation), and while Automatable=yes and Technical Impact=total, EPSS is only 0.48% (40th percentile), there is no CISA KEV listing, and no public exploit code was identified. Net: a genuine authorization/least-privilege defect worth patching, but it is an insider/privilege-boundary problem, not an internet-facing unauthenticated RCE-class emergency the 9.8 implies. The PR:N vs 'requires administrator' conflict should be reconciled with the vendor advisory. |
| Exploit ScenarioDerived | A delegated administrator who legitimately manages Realm A abuses the REST API to request the Connector configuration objects scoped to Realm B, which the realm-permission model should have hidden from them, and receives the full configuration including confidential connection properties such as backend credentials. They then recreate (duplicate) that Connector instance inside Realm A, effectively appropriating another realm's integration and its secrets. No public exploit code has been identified at time of analysis, but the action is a straightforward authenticated REST call. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Cross-realm authorization bypass in Apache Syncope allows an administrator who already holds delegated entitlements in one Realm to read, through the REST API, the full Connector configuration of a different Realm - including confidential properties - and then effectively clone that Connector instance into the Realm they control. The flaw affects the 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 lines, and is exploitable only by an authenticated delegated administrator, not by anonymous remote users; no public exploit code has been identified at time of analysis, EPSS is a low 0.48% (40th percentile), and CISA's SSVC assessment records Exploitation: none. Note that the published CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) overstates the issue: our independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, i.e. a confidentiality-only privilege-boundary weakness rather than an unauthenticated, integrity- and availability-destroying flaw.
RemediationAI
Vendor-released patch: upgrade to Apache Syncope 4.0.8 or 4.1.3, which the advisory states fix the issue; note that no patched 3.0.x release is listed, so 3.0.0-M0-3.0.16 users must plan a migration to one of the 4.x fixed versions rather than expect a 3.0.x backport. Until the upgrade is deployed, the most effective compensating control is to review and tighten delegated entitlements: remove any Realm administrator who is not strictly required to manage Connectors, since the vulnerability only yields data to an admin who already holds Entitlements in some Realm - the trade-off is reduced operational autonomy for delegated tenant administrators and more centralised connector management. Because Connector configuration objects containing confidential properties may already have been disclosed, treat those secrets as potentially compromised and rotate the credentials embedded in every Realm's Connector configuration, accepting a short provisioning/outage window while targets are updated. Additionally, restrict REST API exposure to trusted management networks or a reverse proxy with strict access rules (side effect: legitimate remote administration and automation must be routed through that path), and audit each Realm's Connector inventory and Syncope audit logs for Connector instances that appear duplicated across Realms, which would indicate prior cross-Realm cloning. Vendor detail is at https://lists.apache.org/thread/4lgsbbgc72mngf6mc1q5b1cj3d9nyphn and https://seclists.org/oss-sec/2026/q3/761. Automated exploitation is assessed as feasible (SSVC Automatable: yes), so prioritise the upgrade and secret rotation even though EPSS currently sits at 0.48% and no public exploit or KEV entry exists.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Syncope is an open-source identity and access management / identity governance platform written in Java, used to provision accounts to target systems through Connectors (LDAP, database, SCIM, REST, and similar bundles). Syncope is multi-tenant via Realms, and administrative duties are delegated so that an admin can be granted entitlements to administer only specific Realms. The root cause is CWE-863 (Incorrect Authorization): the REST endpoints that serve Connector configuration objects fail to scope the authorization check to the caller's own Realm, so an administrator legitimately entitled in Realm A can retrieve Connector configuration belonging to Realm B. Because Connector configuration carries confidential properties (binding credentials, connection passwords and similar secrets), the disclosure is not merely metadata - it exposes credentials that can then be reused to instantiate a duplicate Connector under the attacker's own Realm. EUVD mirrors the affected ranges (Apache Syncope 3.0.0-M0 ≤ 3.0.16, 4.0.0-M0 ≤ 4.0.7, 4.1.0-M0 ≤ 4.1.2) and the CISA SSVC entry records Exploitation: none, Automatable: yes, Technical Impact: total under that framework's definition, though the concrete effect here is unauthorized cross-Realm disclosure of configuration secrets rather than loss of integrity or availability in the victim Realm.
Know when Syncope gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Requires an authenticated delegated realm admin so PR:L not PR:N; impact is cross-realm disclosure of confidential connector properties (C:H) with no modification (I:N) or availability loss (A:N).
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
3DescriptionCVE.org
Incorrect Authorization vulnerability in Apache Syncope.
An administrator with adequate entitlements in a given Realm may be able to read via REST the full Connector configuration, confidential properties included, scoped in another Realm and thus be able to effectively duplicate such Connector instance into the Realm they have administration rights for.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2.
Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
Executive ViewAI
Apache Syncope, the identity governance and administration platform used to broker accounts and entitlements across downstream systems, carries a cross-realm authorization flaw that allows a delegated administrator trusted in one realm to read another realm's full Connector configuration - including confidential properties - and then effectively clone that connector into the realm they control. The exposure is limited to organizations running affected 3.0.x, 4.0.x, or 4.1.x releases with delegated, multi-realm administration in use; exploitation requires an authenticated delegated administrator, and no public exploit identified at time of analysis. Leadership should care because the assets at risk are the connectors and credentials binding Syncope to downstream identity stores, which means the impact is contained but sits directly on a trust boundary - and because no vendor-released patch identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce strict realm-to-administrator least privilege and remove standing delegated entitlements that span realms; limit REST API exposure to trusted management networks or a bastion; enable and monitor per-realm audit logs for connector read, create, and update operations; rotate confidential connector properties and credentials that may have been reachable cross-realm; and deploy detection for connector configuration reads originating from administrators outside the connector's owning realm.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and un
Missing authorization in Apache Syncope (3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2) le
Incorrect authorization in Apache Syncope allows a delegated administrator who holds only the ClientApp CREATE entitleme
Incorrect authorization in Apache Syncope (3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2)
Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1
A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary
An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupporte
Apache Syncope can be configured to store the user password values in the internal database with AES encryption, though
Apache Syncope's pluggable extension mechanism lets a user holding administrator rights supply custom interface implemen
In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow
An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not li
Stacked SQL injection in Apache Syncope (3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2) al
Exploit-DB