EUVD-2026-77462
GHSA-q5mc-rwjh-9x5q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with search entitlement
-
DeliveryIssue non-recursive search request
-
ExploitRealms filter renders empty
-
ExecutionBackend query returns unscoped results
-
ImpactRead cross-realm identity data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated Syncope principal with a search entitlement able to submit a NON-RECURSIVE search request (recursive searches are not affected per the description). The flaw is backend-agnostic - it manifests regardless of whether the deployment uses the JPA/SQL, Neo4j, or Elasticsearch/OpenSearch persistence/search backend, because the defect is in how the Realms filter is rendered before query transformation. Limiting factors: exploitation is gated by authentication and possession of a search entitlement (not open to anonymous remote attackers), and only non-recursive queries trigger the empty-filter condition; impact is confined to reading identity/entity data outside the requester's authorized realms rather than modifying data or disrupting service. Affected: Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2; fixed in 4.0.8 / 4.1.3. |
| Impact | Signals conflict sharply. The vendor CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) implies remote, unauthenticated, full-triad compromise, but the description describes a broken authorization check on SEARCH results: for non-recursive searches the Realms filter can render empty, so results are not scoped to the requester's permitted realms. Performing a search in Apache Syncope requires an authenticated principal holding a search entitlement, so PR:N is almost certainly overstated (assessed PR:L). The impact is disclosure of identity data (users/groups/resources) belonging to realms the requester should not see - a confidentiality issue - not the integrity/availability compromise the 9.8 asserts, so I:H and A:H are overstated as well. Corroborating this lower-than-9.8 real risk: SSVC lists Exploitation as 'none' (no observed exploitation) though Automatable 'yes' and Technical Impact 'total'; EPSS is low at 0.48% (40th percentile); there is no CISA KEV listing and no public POC. Net: this is a genuine, easily-triggered access-control flaw worth prioritizing for patching in any environment running the affected Syncope versions, but the raw 9.8 overstates it - realistic risk is authenticated cross-realm information disclosure, not unauthenticated RCE-class total compromise. The PR:N vs 'search requires authentication' discrepancy should be verified against the Apache advisory before treating this as unauthenticated. |
| Exploit ScenarioDerived | An authenticated Syncope user (e.g., a delegated administrator scoped to a single realm, or any account with a search entitlement) issues a non-recursive search request via the REST/UI search API. The Realms filter that should constrain results to their permitted realms is rendered empty, so the backend query (SQL, Neo4j, or Elasticsearch/OpenSearch) returns matching entities from realms across the entire deployment, disclosing user, group, and resource data outside the requester's authorization scope. No public exploit code is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Incorrect authorization in Apache Syncope (3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2) allows an authenticated principal that holds a search entitlement to retrieve identity and entity records outside its authorized realms by issuing a non-recursive search request. The Realms filter that normally constrains results to the requester's permissions can be rendered empty for non-recursive queries, effectively removing the privilege restriction before the search is translated into SQL, Neo4j, or Elasticsearch/OpenSearch queries; recursive searches are not affected. The exposure is backend-agnostic but gated by authentication and an existing search entitlement, so it is a data-confidentiality bypass rather than anonymous remote code execution - no public exploit code has been identified at time of analysis, EPSS is low (0.48%, ~40th percentile), and there is no CISA KEV listing. Vendor fixes are available in 4.0.8 and 4.1.3.
RemediationAI
Vendor-released patch: upgrade to Apache Syncope 4.0.8 or 4.1.3, which the project states fix the issue for the 4.0.x and 4.1.x lines respectively (see https://lists.apache.org/thread/ykwnkrt2b43d0wm1phh94pqqyjb6qyhx and https://seclists.org/oss-sec/2026/q3/760). No fixed release is named for the 3.0.x line, so 3.0.0-M0 through 3.0.16 deployments should plan a migration to 4.0.8/4.1.3 or treat the branch as unsupported. Where immediate upgrading is not possible, the effective compensating control is to tighten the authorization surface that triggers the empty filter: remove or narrowly scope SEARCH-related entitlements for non-administrative users and roles, since exploitation requires a principal permitted to submit searches, and audit which accounts currently hold broad search rights - the trade-off is reduced self-service and delegated administration functionality for those users. Restrict network access to the Syncope REST/console endpoints to trusted administrative networks so that only vetted principals can reach the search API, accepting the loss of remote end-user access. Because the defect spans all persistence backends, substituting Neo4j for JPA/SQL or vice versa provides no protection and should not be counted as a workaround. Detection should focus on non-recursive search API calls from non-privileged principals returning unusually large or cross-realm result sets, since the vulnerable path leaves no constraint in the generated backend query; there is no separate vendor hotfix or configuration flag known at time of analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Syncope is an open-source identity and access management (IAM) platform whose search subsystem accepts a search request, applies a Realms filter derived from the requester's entitlements, and then translates the resulting abstract query into the native query language of whichever backend is configured - JPA/SQL, Neo4j, or Elasticsearch/OpenSearch. The vulnerability is an instance of CWE-863 (Incorrect Authorization): for non-recursive search requests the Realm filter fragment can be produced as an empty expression, so the backend query is executed with no realm constraint at all, returning objects the requester is not entitled to see. Because the defect lives in the filter-rendering stage that precedes backend-specific query generation, it is deployment-agnostic and manifests equally on relational, graph, and document-store backends - a detail that also means switching persistence engines is not a mitigation. The NVD-assigned vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) implies anonymous, high-integrity-impact exploitation; our independent assessment is materially narrower (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), since the condition requires an authenticated principal with a search entitlement and only three read/query paths are affected by the empty filter, with no demonstrated write or availability impact.
Know when Syncope gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Search requires an authenticated user with a search entitlement (PR:L); the flaw discloses cross-realm identity data (C:H), enables at most limited downstream integrity effects (I:L) and no availability impact (A:N).
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
3DescriptionCVE.org
Incorrect Authorization vulnerability in Apache Syncope.
Any search requests are transformed into SQL, Neo4J or Elasticsearch / Opensearch queries, depending on the actual deployment configuration. An important component of such transformation is the Realms filter, which ensures that the search results are matching the requester's permissions. For non-recursive search requests it is possible that such Realms filter is rendered as empty, thus voiding any restriction on requester privileges.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2.
Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
Executive ViewAI
Apache Syncope is commonly the authoritative store for workforce and customer identity records, and this critical authorization defect lets any account that already holds a search entitlement pull identity and entity records from realms it was never granted, directly bypassing the platform's realm-based access model rather than posing a code-execution risk. Organizations running 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, or 4.1.0-M0 through 4.1.2 should treat this as a potential confidentiality breach of their identity estate and act on it independently of the low EPSS score (0.5%) and the absence of any public exploit identified at time of analysis. Leadership should care because the records at risk are precisely the identity and entitlement data that other business systems trust when making access decisions.
Patch data is reported inconsistently in the source material: the structured patch field indicates no patch, while the advisory text names vendor fixes in 4.0.8 (for 4.0.x) and 4.1.3 (for 4.1.x). Confirm with the vendor and, where those builds are available, apply the vendor patch. No fix version was identified for the 3.0.x line at time of analysis, so interim mitigations there are to restrict search entitlements to least privilege, remove search rights from accounts that do not need them, block or alert on non-recursive search requests at the API gateway or reverse proxy, and review Syncope and backend audit logs for cross-realm record retrieval.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and un
Missing authorization in Apache Syncope (3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2) le
Incorrect authorization in Apache Syncope allows a delegated administrator who holds only the ClientApp CREATE entitleme
Cross-realm authorization bypass in Apache Syncope allows an administrator who already holds delegated entitlements in o
Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1
A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary
An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupporte
Apache Syncope can be configured to store the user password values in the internal database with AES encryption, though
Apache Syncope's pluggable extension mechanism lets a user holding administrator rights supply custom interface implemen
In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow
An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not li
Stacked SQL injection in Apache Syncope (3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2) al
Exploit-DB