AI analysis
Apache Syncope, an open-source identity management (IdM) server, exposes sensitive information to an unauthorized actor through its REST API: an administrator with adequate entitlements can retrieve the list of all existing access tokens, including their signed JWT bodies. By replaying one of these stolen JWTs, that administrator can issue further REST requests while impersonating users who hold higher administration entitlements, effectively escalating to full administrative control of the identity deployment. The flaw affects Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2, and is fixed in 4.0.8 and 4.1.3. No CVSS score has been assigned yet, no public proof-of-concept is known, and there is no evidence of exploitation in the wild.
What to do: Upgrade to Apache Syncope 4.0.8 or 4.1.3 as soon as possible — the 3.0.x line has no fixed release, so 3.0.16 users must migrate to a patched 4.x version. After upgrading, revoke and reissue all access tokens and review REST audit logs for any administrative enumeration of the token list or anomalous authenticated requests. Until patched, restrict the entitlements that permit listing access tokens via REST.
Affected
| Apache Syncope | 3.0.0-M0 through 3.0.16 |
| Apache Syncope | 4.0.0-M0 through 4.0.7 |
| Apache Syncope | 4.1.0-M0 through 4.1.2 |
Estimated exposure
nichelikely hundreds to low thousands of self-hosted enterprise deployments worldwide (order of magnitude ~1,000) — Syncope is a self-hosted, open-source enterprise IdM server with no published install counts; deployments are typically internal corporate identity backends rather than internet-facing services, so the exposed population is small.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Syncope. An administrator with adequate entitlements can get access via REST to the list of existing Access Tokens, including their signed JWT body. These values can be then used to perform further REST requests, impersonating users with higher administration entitlements. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.