Apache Syncope EUVD-2026-77464

Requires an authenticated Syncope account that has been granted delegation management for a realm subtree; the attacker uses the delegation create/update function to attach Roles not owned by the delegating user or belonging to a different realm subtree than the one delegation management was authorized for. Limiting factors: exploitation is post-authentication (a valid account with delegation privileges is needed) and depends on the delegation feature being in use; it is not exploitable by fully unauthenticated remote attackers against a default install despite the PR:N in the published vector. Affected deployments are Apache Syncope 3.0.0-M0-3.0.16, 4.0.0-M0-4.0.7, and 4.1.0-M0-4.1.2; upgrading to 4.0.8 / 4.1.3 remediates.

This is an authorization/privilege-escalation flaw (CWE-269) in Apache Syncope's delegation feature, not a memory-safety or unauthenticated RCE bug. The published CVSS is 9.8 with vector AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H, but the description explicitly states that 'Delegations can be created or updated' by 'the delegating User' who has 'delegation management granted for' a realm subtree - this is inherently an authenticated action, so the PR:N (unauthenticated) metric is almost certainly overstated; it should realistically be PR:L. The C:H/I:H are defensible because an actor can attach Roles they do not own or that belong to other realm subtrees, escalating their effective authority, but A:H (availability) is not supported by the description and looks inflated. Corroborating this lower real-world urgency: EPSS is only 0.48% (40th percentile), SSVC exploitation status is 'none' (no observed exploitation), there is no CISA KEV listing and no public POC. SSVC does flag Automatable:yes and Technical Impact:total, which reflects that once an authenticated low-privilege user reaches the delegation endpoint the escalation is straightforward and high-impact. Net: a genuinely serious privilege-escalation issue for organizations running Syncope, but the headline 9.8 overstates it - the true risk is a post-authentication privilege escalation (PR:L), not a wormable unauthenticated network exploit. No active exploitation and no exploit code are known at time of analysis.

An authenticated Syncope user who has been granted delegation management for a limited realm subtree creates or updates a delegation, assigning Roles that they do not own or that belong to a different realm subtree, thereby granting themselves (or a delegate) privileges beyond their authorized scope. No public exploit code exists and no active exploitation has been observed; the attack requires valid credentials with delegation privileges and is straightforward to perform once that access is held.