Apache Syncope authorization bypass through User-Controlled key (CVE-2026-113511)
Delegated administrators can bypass Realm update boundaries without destination permission.
55
Vulnerability1 · 1 read
CVE-2026-113511
Auth bypass in Apache Syncope for Realm subtree relocation across boundaries
- CVSS 3.1
- 9.1 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache Syncope allows a delegated administrator to relocate a Realm subtree across administrative realm boundaries without destination permissions via user-controlled key. This bypasses authorization controls. An attacker gains unauthorized Realm access. Affected are Syncope users on specified versions.
What to do: Upgrade to Apache Syncope 4.0.9 or 4.1.4. No workaround mentioned.
| Product | Affected | Fixed in |
|---|---|---|
| Apache Syncope | 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3 | 4.0.9 / 4.1.4 |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Authorization bypass through User-Controlled key vulnerability in Apache Syncope. A delegated administrator can relocate a Realm subtree across administrative realm boundaries without permission for the destination This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3. Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.
- Weakness
- CWE-639
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N