CVE-2026-73470: Apache Syncope: Delegating users can grant unowned Roles

Apache Syncope, an open-source enterprise identity management (IdM) platform, contains an improper privilege management flaw (CWE-269) in its delegation feature: a user authorized to manage delegations can create or update a delegation that includes Roles the delegating user does not own, or that targets a Realm outside the subtree the delegation authority was granted for. The issue is triggered through normal delegation administration by an authenticated user, and exploitation allows them to confer roles beyond their legitimate entitlements — potentially including administrative roles — to themselves or others, expanding control over managed identities, accounts, and provisioning workflows. Affected deployments are those running Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, or 4.1.0-M0 through 4.1.2. No public proof of concept exists, there is no evidence of exploitation in the wild, and CVSS has not yet been scored.

Do: Upgrade to Apache Syncope 4.0.8 or 4.1.3; 3.0.x users must move to a patched 4.x release since no 3.0 fix was issued. Until upgraded, audit existing delegations for Roles not owned by the delegating user or outside the granted Realm subtree, and restrict delegation-management rights to a minimal set of trusted administrators. Review historical delegation create/update events in logs for signs of prior abuse.