CVE-2026-73370

Apache Syncope, an open-source identity management (IdM) platform, contains an incorrect authorization flaw (CWE-863) in the Reconciliation service: the delegated-administration security checks applied to its pull and push operations are incomplete. As a result, an administrator account that was never granted the required entitlements can still invoke reconciliation pull and push actions, which synchronize identities across realms and connected resources — enabling reconciliation to be triggered across realm boundaries beyond that admin's delegated scope. This can let an under-privileged or rogue delegated administrator read or alter identity data (users, groups, accounts on connected systems) outside the realm they administer. Affected versions are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2; fixes are available in 4.0.8 and 4.1.3, with no fixed 3.0.x release listed. The issue has no CVSS score yet, is not in the CISA KEV catalog, and there is no known public PoC or evidence of in-the-wild exploitation.

What to do: Upgrade immediately to Apache Syncope 4.0.8 or 4.1.3; organizations still on the 3.0.x line must upgrade to a fixed 4.x release since no 3.0 fix was published. Restrict access to the Reconciliation service (pull/push) so only fully entitled administrators can invoke it, and audit logs for pull/push executions initiated by delegated administrators who lacked the corresponding entitlements. Investigate any resulting cross-realm identity changes or unexpected synchronizations to connected resources.