Skip to content
NewA calmer, faster ZeroHour
Vulnerabilityinfo

Apache Syncope AuthProfile value escalation via self-service update (CVE-2026-110535)

Original title: CVE-2026-110535: Apache Syncope: AuthProfile value escalation via self-service update

oss-security ()1
Read at seclists.org
Part of a story covered by 5 sourcesApache Syncope vulnerabilities enable RCE, bypasses and escalationMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Non-admin users can configure impersonation for WA surrogate authentication through self-updates.

Apache Syncope versions 3.0.12 through 3.0.16, 4.0.0-M0 through 4.0.8 and 4.1.0-M0 through 4.1.3 contain an improper privilege management vulnerability. AuthProfile self-updates allow non-admin users to configure impersonation for WA surrogate authentication. This issue affects the listed versions.

Key facts
  • Apache Syncope 3.0.12 through 3.0.16
  • Apache Syncope 4.0.0-M0 through 4.0.8
  • Apache Syncope 4.1.0-M0 through 4.1.3
Security assessment · AI, from the article
What to do
  1. 1.Upgrade to Apache Syncope 3.0.16 or later
  2. 2.Upgrade to Apache Syncope 4.0.8 or later
  3. 3.Upgrade to Apache Syncope 4.1.3 or later
Analyze CVE-2026-110535 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-110535
Tags
syncopeprivilege-escalationimpersonation
Vendors
Apache
Products
Syncope

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-110535
Improper Privilege Management in Apache Syncope (AuthProfile self-updates)
8.8—

From the original article

Posted by Francesco Chicchiriccò on Nov 02 Severity: important Affected versions: - Apache Syncope 3. 0. 12 through 3.

oss-security

seclists.org

Read the full article at oss-security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.