CVE-2026-73236

Apache Syncope, an open-source identity management platform, enforces delegated administration entitlements by checking whether a target object's Realm sits under an administrator's assigned Realm, using prefix matches on realm names. Due to an incorrect implementation (CWE-863), two sibling Realms whose names begin with the same string cannot be distinguished, so a delegated administrator for one Realm can effectively act on objects in the other Realm. An authenticated attacker holding delegated-administrator rights over one realm gains unauthorized access to users, groups, and other managed objects in the sibling realm — a horizontal privilege escalation between administrative domains. Affected deployments are Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2; fixes ship in 4.0.8 and 4.1.3, with no patched 3.0.x release listed. No public proof of concept is known, the issue is not in CISA's KEV, and there is no indication of exploitation in the wild.

What to do: Upgrade to Apache Syncope 4.0.8 or 4.1.3 as soon as possible; 3.0.x has no fixed release, so deployments on that line must migrate to a patched 4.x version. Until patched, avoid sibling Realm names that share a leading string and review delegated-administration assignments for realms whose names could collide. Audit Syncope logs for delegated administrators performing operations on realms outside their assigned scope.