CVE-2026-732367.5HighCWE-863
Apache Syncope: Cross-Realm authorization bypass in delegated administration
Apache Software Foundation · Apache Syncope
Not in CISA KEVVendor fix available
0.4%probability of exploitation in the next 30 days
29th percentile
050100
Higher than 29% of scored CVEs
7.5HighCVSS
LowMediumHighCrit.
DescriptionNVD
Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks are based on Realm hierarchy and enforced via prefix matches. Due to incorrect implementation, two sibling Realms whose names begin with the same string cannot be correctly distinguished, resulting in incorrect authorization. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 16 Sep.
- Apache Syncope Fixes Six Flaws, Including Critical SQL Injection and Sandbox EscapeSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.