CVE-2026-77181: Apache Syncope: ClientApp update entitlement not effective
Apache Syncope discloses low-severity CVE-2026-77181, an incorrect authorization flaw where the ClientApp update entitlement is not effective in versions 3.0.x through 4.1.2.
Francesco Chicchiriccò posted a low-severity advisory for CVE-2026-77181, an Incorrect Authorization vulnerability in Apache Syncope's syncope-core-am-logic module. Affected versions include 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. An administrator holding the ClientApp update entitlement finds it is not applied as expected. No exploitation is reported and the issue is rated low severity.
- CVE-2026-77181 rated low severity, incorrect authorization in Apache Syncope.
- Affects syncope-core-am-logic 3.0.0-M0–3.0.16, 4.0.0-M0–4.0.7, 4.1.0-M0–4.1.2.
- ClientApp update entitlement fails to take effect for administrators.
- No exploitation observed; no PoC mentioned.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-77181 | Broken entitlement check on ClientApp updates in Apache Syncope | 9.8 | — |
From the original article
Posted by Francesco Chicchiriccò on Sep 14 Severity: low Affected versions: - Apache Syncope (org. apache. syncope.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.