CVE-2026-75030

Apache Syncope, an open-source identity management system, contains a missing authorization flaw (CWE-862) in which group-level administration checks are not enforced during task execution. An administrator who holds only task execution entitlements can trigger group member provisioning or deprovisioning tasks that add or remove users from groups at scale, even for groups they are not entitled to administer. Successful abuse lets such an attacker grant unauthorized access to connected resources via mass group assignments, or cause widespread and disruptive access revocation across downstream systems. Affected deployments are Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. There is currently no evidence of exploitation: no public PoC is known and the CVE is not in the CISA KEV catalog.

What to do: Upgrade to Apache Syncope 4.0.8 or 4.1.3; note that the 3.0.x line has no fixed release, so 3.0 deployments should migrate directly to a patched 4.x version. Until patched, restrict task execution entitlements to a minimal set of fully trusted administrators. Audit task execution history and group membership changes for any unexpected mass provisioning or deprovisioning of group members.