CVE-2026-75030: Apache Syncope: Incomplete authorization checks for Group members deprovisioning
Apache Syncope patches missing authorization checks (CVE-2026-75030) in Group members deprovisioning that administrators can abuse.
CVE-2026-75030 is a moderate-severity missing authorization vulnerability in Apache Syncope's Group members deprovisioning logic (syncope-core-idrepo-logic). An administrator with task execution permissions can bypass the incomplete authorization checks. Affected versions include 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.
- Incomplete authorization checks in Group members deprovisioning
- Rated moderate severity, missing authorization class
- Exploitable by an administrator with task execution permissions
- Affects 3.0.x, 4.0.x, and 4.1.x release lines
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-75030 | Missing Authorization in Apache Syncope Enables Mass Group Member (De)Provisioning | 9.8 | — |
From the original article
Posted by Francesco Chicchiriccò on Sep 14 Severity: moderate Affected versions: - Apache Syncope (org. apache. syncope.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.