EUVD-2026-77474
GHSA-82x7-r2q8-xr3h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain delegated administrator credentials
-
DeliveryIdentify target sibling Realm sharing a name prefix with granted scope
-
ExploitIssue administrative API request targeting sibling Realm path
-
ExecutionSyncope prefix check incorrectly matches and authorizes the request
-
ImpactGain unauthorized read/write administrative access to unintended Realm
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires all of the following: (1) the attacker holds valid delegated administrator credentials within the target Syncope instance (authenticated, PR:L equivalent); (2) the deployment contains at least two sibling Realms - Realms that share the same parent - whose names share a common leading substring (e.g., 'hr' and 'hr-contractors'); and (3) the attacker's delegation scope is bound to the shorter-named Realm. Deployments with a single Realm, with no delegated administration in use, or where all sibling Realms have distinct name prefixes are not exploitable. Exploitation is limited by the authentication requirement and the specific Realm naming configuration; the PR:N in the vendor CVSS vector is inconsistent with these prerequisites. |
| Impact | The vendor CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N) overstates real-world risk in two meaningful ways: delegated administration is inherently an authenticated function, making PR:N inconsistent with the description, and the attack requires the deployment to contain sibling Realms whose names share a leading string, which is a specific configuration condition rather than a universal default. SSVC confirms exploitation status as 'none' and technical impact as only 'partial', and no EPSS value was furnished in the input data - exploitation likelihood must therefore be inferred from the SSVC signal alone. With no KEV entry and no public exploit code, this does not demand emergency out-of-band response; even a mid-sized municipal IT team in sopot running Syncope with multiple delegated Realm tenants should treat the upgrade as urgent but schedulable within a normal patch cycle. The automatable flag in SSVC means that once conditions are met, exploitation requires no manual interaction per target, raising the priority slightly for multi-tenant deployments. |
| Exploit ScenarioDerived | A delegated administrator scoped to the Realm named 'finance' issues an API request targeting a user or resource that belongs to the sibling Realm 'finance-external'. The broken prefix check evaluates 'finance' as a prefix of 'finance-external' and grants the request, giving the delegated admin full administrative access over the unintended Realm. No public exploit code exists, but the attack requires only constructing a standard Syncope delegated-admin API call with the sibling Realm as the target. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 15, 2026
Incorrect authorization in Apache Syncope's delegated administration module allows an authenticated delegated administrator to exercise privileges over a sibling Realm they were never granted access to, by exploiting a prefix-string matching flaw in the Realm hierarchy enforcement code. Affected releases span the entire 3.0.x (through 3.0.16), 4.0.x (through 4.0.7), and 4.1.x (through 4.1.2) branches. No public exploit has been identified and SSVC confirms no active exploitation; vendor-released patches 4.0.8 and 4.1.3 are available and should be applied promptly by any organization using delegated multi-tenant Realm structures.
RemediationAI
Upgrade to Apache Syncope 4.0.8 or 4.1.3, which correct the prefix-match anchoring logic in delegated administration authorization, as specified in the vendor advisory at https://lists.apache.org/thread/5m8t357n2xt38ym5l2rrgbjyztd97yjv. A fix for the 3.0.x branch is not confirmed in the available references; 3.0.x deployments should migrate to 4.0.8 or 4.1.3 or contact the Apache Syncope project for a 3.0.x backport. As a temporary compensating control, administrators can audit all Realm naming to ensure no two sibling Realms share a leading string (for example, renaming 'engineering' and 'engineering-contractors' to 'eng-core' and 'eng-contractors'); note that this workaround is operationally fragile, does not remove the underlying code defect, and must be maintained as new Realms are created.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Syncope is an open-source Identity Governance and Administration (IGA) platform that organises managed objects within a hierarchical Realm structure, identified by CPE cpe:2.3:a:apache_software_foundation:apache_syncope:*:*:*:*:*:*:*:*. Delegated administration scopes a designated administrator's privileges to a specific Realm sub-tree, and authorization checks are enforced by testing whether a target Realm's path begins with the delegated scope's path prefix. The root cause (CWE-863, Incorrect Authorization) is that the prefix comparison is not properly anchored with a path separator, so a scope of 'team' incorrectly satisfies an authorization check against the sibling Realm 'teamlead' because the raw string 'teamlead' does start with 'team'. This is a classical off-by-one anchoring error in access-control prefix logic, not a memory-safety issue.
Know when Apache Syncope gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Requires authenticated delegated admin access (PR:L) and sibling Realms with overlapping name prefixes as a deployment condition (AC:H); confidentiality impact is partial since unauthorized Realm access enables both read and administrative write.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
2DescriptionCVE.org
Incorrect Authorization vulnerability in Apache Syncope.
Delegated administration security checks are based on Realm hierarchy and enforced via prefix matches. Due to incorrect implementation, two sibling Realms whose names begin with the same string cannot be correctly distinguished, resulting in incorrect authorization.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2.
Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
Executive ViewAI
Apache Syncope versions 3.0.x through 4.1.2 contain an authorization bypass in the delegated administration module allowing authenticated administrators to access sibling tenant realms beyond their assigned scope. This creates insider threat and data isolation risk for organizations using multi-tenant Realm structures where administrators manage separate customer environments. Any deployment with delegated role-based Realm administration requires immediate action.
Apply vendor patch (4.0.8 for 4.0.x branch, 4.1.3 for 4.1.x branch). For 3.0.x branch with no released patch, restrict delegated administrator role permissions to assigned Realms only through role configuration and implement audit logging for all Realm access by delegated administrators.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
More in Apache Syncope
View allSQL injection in Apache Syncope allows an administrator holding sufficient entitlements to execute arbitrary SQL through
Privilege escalation in Apache Syncope's identity-management engine lets a self-service user grant themselves defined Ro
SQL injection in Apache Syncope's Task search endpoint allows an authenticated administrator to execute arbitrary SQL th
Server-Side Request Forgery in Apache Syncope lets a low-privileged authenticated user abuse the Connectors and Resource
OIDC client secret exposure in Apache Syncope enables any authenticated user to retrieve complete OIDC provider configur
Sensitive AES key material is written in plaintext to Apache Syncope application logs under a specific misconfiguration
CSV formula injection in Apache Syncope allows authenticated low-privilege users to embed spreadsheet formula payloads i
Code execution via Groovy sandbox bypass in Apache Syncope 3.0 through 3.0.16, 4.0 through 4.0.5, and 4.1.0 allows a hig
Remote code execution in Apache Syncope's connector subsystem allows an administrator holding sufficient entitlements to
Remote code execution in Apache Syncope's workflow engine lets an administrator holding sufficient entitlements run arbi
Groovy sandbox escape in Apache Syncope's Implementations feature lets an administrator holding Implementation entitleme
Broken delegated-administration authorization in Apache Syncope's Reconciliation service lets an authenticated administr
Exploit-DB