CVE-2026-73668: Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values

Apache Syncope, an open-source identity and access management (IdM) platform, contains an incorrect authorization flaw (CWE-863) in its REST API that lets an authenticated administrator who has full entitlements in one Realm read the complete Connector configuration scoped to a different Realm — including confidential properties such as the credentials used to bind to connected external resources (e.g., LDAP/AD, databases) via ConnId connector bundles. The attacker gains those secrets and can effectively clone the Connector instance into their own Realm, giving them working credentials for the target Realm's backend systems and enabling lateral movement outside their delegated administrative scope. The issue affects Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2; it is fixed in 4.0.8 and 4.1.3 (the 3.0.x line has no listed fix, so those users must upgrade to a fixed 4.x release). Exploitation requires an already-privileged internal account, so the risk is primarily privilege escalation across realm boundaries by semi-trusted or compromised tenant administrators. No CVSS score has been assigned, it is not in the CISA KEV catalog, and no public proof of concept or known in-the-wild exploitation exists.

Do: Upgrade Apache Syncope to 4.0.8 or 4.1.3; deployments still on the 3.0.x line (up to 3.0.16) have no fixed 3.0.x release and should migrate to a fixed 4.x version. Until patched, minimize the number of realm-scoped administrators, review REST access logs for any admin reading Connector configurations outside their own Realm, and rotate the credentials stored in Connector confidential properties (e.g., LDAP/AD and database bind accounts) since they may have been readable cross-realm.