CVE-2026-734709.8CriticalCWE-269
Apache Syncope: Delegating users can grant unowned Roles
Apache Software Foundation · Apache Syncope
Not in CISA KEVVendor fix available
0.5%probability of exploitation in the next 30 days
43rd percentile
050100
Higher than 43% of scored CVEs
9.8CriticalCVSS
LowMediumHighCrit.
DescriptionNVD
Improper Privilege Management vulnerability in Apache Syncope. Delegations can be created or updated with Roles not owned by the delegating User, or not for the same Realm subtree under the delegation management was granted for. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 16 Sep.
- Apache Syncope Fixes Six Flaws, Including Critical SQL Injection and Sandbox EscapeSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.