CVE-2026-78330

Apache Syncope contains an incorrect privilege assignment flaw (CWE-266) in its internal JWT authentication mechanism. If an attacker learns the configured JWKS settings for internal JWT authentication (at least the protocol and the key), they can combine that knowledge with a legitimately obtained low-privilege JWT to escalate to full admin privileges. Successful exploitation grants complete administrative control over the identity management deployment, including user accounts, entitlements, and provisioning to connected systems. Affected deployments are Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2; the issue is fixed in 4.0.8 and 4.1.3. There is no CVSS score yet, no public proof of concept, and no known exploitation in the wild.

What to do: Upgrade immediately to Apache Syncope 4.0.8 or 4.1.3; note that 3.0.x deployments have no fixed release on that line and should move to a patched 4.x version. Treat the JWKS configuration (protocol and signing key) as a secret: do not disclose it, rotate the internal JWT signing keys after upgrading, and restrict access to configuration and admin endpoints. Review authentication and audit logs for anomalous low-privilege accounts performing admin-level operations.