Apache Syncope authorization bypass through User-Controlled key (CVE-2026-113511)
Original title: CVE-2026-113511: Apache Syncope: Delegated administration boundaries can be bypassed for Realm update
Delegated administrators can bypass Realm update boundaries without destination permission.
Apache Syncope versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8 and 4.1.0-M0 through 4.1.3 contain an authorization bypass vulnerability. A delegated administrator can relocate a Realm subtree across administrative realm boundaries without permission for the destination. The issue is described as authorization bypass through User-Controlled key.
- Apache Syncope 3.0.0-M0 through 3.0.16
- Apache Syncope 4.0.0-M0 through 4.0.8
- Apache Syncope 4.1.0-M0 through 4.1.3
- 1.Upgrade to Apache Syncope 3.0.16 or later
- 2.Upgrade to Apache Syncope 4.0.8 or later
- 3.Upgrade to Apache Syncope 4.1.3 or later
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-113511 | Auth bypass in Apache Syncope for Realm subtree relocation across boundaries | 9.1 | — |
From the original article
Posted by Francesco Chicchiriccò on Nov 02 Severity: important Affected versions: - Apache Syncope 3. 0. 0-M0 through 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.