Broken Authorization in Apache Syncope Reconciliation Bypasses Delegated-Admin Entitlements
AI analysis
Apache Syncope, an open-source identity management (IdM) platform, contains an incorrect authorization flaw (CWE-863) in the Reconciliation service: the delegated-administration security checks applied to its pull and push operations are incomplete. As a result, an administrator account that was never granted the required entitlements can still invoke reconciliation pull and push actions, which synchronize identities across realms and connected resources — enabling reconciliation to be triggered across realm boundaries beyond that admin's delegated scope. This can let an under-privileged or rogue delegated administrator read or alter identity data (users, groups, accounts on connected systems) outside the realm they administer. Affected versions are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2; fixes are available in 4.0.8 and 4.1.3, with no fixed 3.0.x release listed. The issue has no CVSS score yet, is not in the CISA KEV catalog, and there is no known public PoC or evidence of in-the-wild exploitation.
What to do: Upgrade immediately to Apache Syncope 4.0.8 or 4.1.3; organizations still on the 3.0.x line must upgrade to a fixed 4.x release since no 3.0 fix was published. Restrict access to the Reconciliation service (pull/push) so only fully entitled administrators can invoke it, and audit logs for pull/push executions initiated by delegated administrators who lacked the corresponding entitlements. Investigate any resulting cross-realm identity changes or unexpected synchronizations to connected resources.
Estimated exposure
nicheunknown exact count; plausibly hundreds to low thousands of self-hosted enterprise IdM deployments — Apache Syncope is a self-hosted Java identity-management platform with niche enterprise adoption, no public install statistics, and deployments that are typically internal-facing rather than internet-exposed, so no reliable count exists.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks performed by Reconciliation service's pull and push, being incomplete, could accept calls by administrator not provided with adequate entitlements. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.