AI analysis
Apache Syncope, an open-source identity management and provisioning platform, incorrectly checks authorization for connected application (ClientApp) changes: the CLIENTAPP_UPDATE entitlement is never honored, while the CLIENTAPP_CREATE entitlement is enforced for both create and update operations. The flaw is triggered when an administrator or delegated user calls the ClientApp update operation via the admin console or REST API, causing the wrong entitlement to be evaluated. A user holding only the create entitlement can therefore modify existing ClientApp definitions (such as OIDC/SAML client applications) beyond their intended privileges, while a user holding only the update entitlement is improperly blocked. Affected deployments are Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. No public proof of concept exists and no exploitation in the wild has been reported.
What to do: Upgrade to Apache Syncope 4.0.8 or 4.1.3, which correct the entitlement check; users on the 3.0.x line should migrate to a fixed 4.x release since no 3.0 fix is listed. Until patched, audit which accounts hold the CLIENTAPP_CREATE entitlement and treat them as effectively having ClientApp update rights; review audit logs for unexpected ClientApp modifications by create-only administrators.
Affected
| Apache Software Foundation Apache Syncope | 3.0.0-M0 through 3.0.16 |
| Apache Software Foundation Apache Syncope | 4.0.0-M0 through 4.0.7 |
| Apache Software Foundation Apache Syncope | 4.1.0-M0 through 4.1.2 |
Estimated exposure
nichelikely hundreds to low thousands of deployments worldwide — Apache Syncope is a self-hosted, enterprise-grade identity management platform with no public active-install counts or scan data, and such deployments are typically internal rather than internet-exposed, suggesting a small installed base.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Incorrect Authorization vulnerability in Apache Syncope. An administrator with ClientApp's update entitlement is unable to perform the related operation, while ClientApp's create entitlement is checked both for create and update operations on ClientApp. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.