CVE-2026-77181

Apache Syncope, an open-source identity management and provisioning platform, incorrectly checks authorization for connected application (ClientApp) changes: the CLIENTAPP_UPDATE entitlement is never honored, while the CLIENTAPP_CREATE entitlement is enforced for both create and update operations. The flaw is triggered when an administrator or delegated user calls the ClientApp update operation via the admin console or REST API, causing the wrong entitlement to be evaluated. A user holding only the create entitlement can therefore modify existing ClientApp definitions (such as OIDC/SAML client applications) beyond their intended privileges, while a user holding only the update entitlement is improperly blocked. Affected deployments are Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. No public proof of concept exists and no exploitation in the wild has been reported.

What to do: Upgrade to Apache Syncope 4.0.8 or 4.1.3, which correct the entitlement check; users on the 3.0.x line should migrate to a fixed 4.x release since no 3.0 fix is listed. Until patched, audit which accounts hold the CLIENTAPP_CREATE entitlement and treat them as effectively having ClientApp update rights; review audit logs for unexpected ClientApp modifications by create-only administrators.