CVE-2026-73370: Apache Syncope: Cross-Realm boundaries reconciliation bypass
Apache Syncope CVE-2026-73370 allows reconciliation actions to bypass cross-Realm delegated administration boundaries.
Apache Syncope disclosed CVE-2026-73370, an incorrect authorization vulnerability rated moderate. Delegated administration security checks can be bypassed during reconciliation, allowing actions across Realm boundaries. The flaw affects syncope-core-idm-logic in versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Users should upgrade to the latest fixed releases.
- Reconciliation bypasses cross-Realm delegated administration security checks
- Affects Syncope IDM logic module across 3.0.x, 4.0.x, 4.1.x versions
- Rated moderate by the Apache Syncope project
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-73370 | Broken Authorization in Apache Syncope Reconciliation Bypasses Delegated-Admin Entitlements | 9.8 | — |
From the original article
Posted by Francesco Chicchiriccò on Sep 14 Severity: moderate Affected versions: - Apache Syncope (org. apache. syncope.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.