What is the CVSS score of EUVD-2026-77458?

EUVD-2026-77458 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Apache are affected by EUVD-2026-77458?

We need answer as JSON. Need synthesize. Need follow all rules. Let's parse input. CVE-2026-73668: Incorrect Authorization vulnerability in Apache Syncope.

Apache EUVD-2026-77458

| CVE-2026-73668 CRITICAL

Incorrect Authorization (CWE-863)

2026-09-14 security@apache.org

GHSA-8xq5-27gf-f6pp

Authentication Bypass Apache

9.8

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (apache) · only source for this CVE.

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Sep 15, 2026 - 10:40 vuln.today

CVSS changed

Sep 14, 2026 - 20:22 NVD

9.8 (None) 9.8 (CRITICAL)

CVE Published

Sep 14, 2026 - 13:18 cve.org

CRITICAL 9.8

CVE Published

Sep 14, 2026 - 13:18 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Incorrect Authorization vulnerability in Apache Syncope.

An administrator with adequate entitlements in a given Realm may be able to read via REST the full Connector configuration, confidential properties included, scoped in another Realm and thus be able to effectively duplicate such Connector instance into the Realm they have administration rights for.

This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2.

Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.