AI analysis
Apache Syncope, an open-source identity and access management (IdM) platform, contains an incorrect authorization flaw (CWE-863) in its REST API that lets an authenticated administrator who has full entitlements in one Realm read the complete Connector configuration scoped to a different Realm — including confidential properties such as the credentials used to bind to connected external resources (e.g., LDAP/AD, databases) via ConnId connector bundles. The attacker gains those secrets and can effectively clone the Connector instance into their own Realm, giving them working credentials for the target Realm's backend systems and enabling lateral movement outside their delegated administrative scope. The issue affects Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2; it is fixed in 4.0.8 and 4.1.3 (the 3.0.x line has no listed fix, so those users must upgrade to a fixed 4.x release). Exploitation requires an already-privileged internal account, so the risk is primarily privilege escalation across realm boundaries by semi-trusted or compromised tenant administrators. No CVSS score has been assigned, it is not in the CISA KEV catalog, and no public proof of concept or known in-the-wild exploitation exists.
What to do: Upgrade Apache Syncope to 4.0.8 or 4.1.3; deployments still on the 3.0.x line (up to 3.0.16) have no fixed 3.0.x release and should migrate to a fixed 4.x version. Until patched, minimize the number of realm-scoped administrators, review REST access logs for any admin reading Connector configurations outside their own Realm, and rotate the credentials stored in Connector confidential properties (e.g., LDAP/AD and database bind accounts) since they may have been readable cross-realm.
Affected
| Apache Syncope | 3.0.0-M0 through 3.0.16 |
| Apache Syncope | 4.0.0-M0 through 4.0.7 |
| Apache Syncope | 4.1.0-M0 through 4.1.2 |
Estimated exposure
nicheunknown exact count; likely low thousands of self-hosted enterprise instances at most — Apache Syncope is a self-hosted, enterprise IdM server typically deployed on internal networks rather than internet-facing, and no public active-install counts or internet-scan data are available, so the exposed population is limited to…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Incorrect Authorization vulnerability in Apache Syncope. An administrator with adequate entitlements in a given Realm may be able to read via REST the full Connector configuration, confidential properties included, scoped in another Realm and thus be able to effectively duplicate such Connector instance into the Realm they have administration rights for. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.