CVE-2026-73579: Apache Syncope: Non-recursive Any search could skip Realms restrictions
Apache Syncope non-recursive Any search can skip Realms restrictions, exposing objects outside an administrator's authorized realm (CVE-2026-73579).
CVE-2026-73579 is an incorrect authorization vulnerability in Apache Syncope where non-recursive Any search requests are transformed in a way that skips Realms restrictions, returning objects outside the administrator's authorized realm. Affected component is syncope-core-persistence-common 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Apache rates the issue moderate severity.
- CVE-2026-73579 rated moderate severity
- Non-recursive Any search bypasses Realms restrictions
- Affects syncope-core-persistence-common 3.0.x, 4.0.x, 4.1.x lines
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-73579 | Broken Realm Authorization in Apache Syncope Search Lets Users See All Identities | 9.8 | — |
From the original article
Posted by Francesco Chicchiriccò on Sep 14 Severity: moderate Affected versions: - Apache Syncope (org. apache. syncope.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.