CVE-2026-73236: Apache Syncope: Cross-Realm authorization bypass in delegated administration
Apache Syncope CVE-2026-73236 bypasses delegated administration checks for sibling Realms sharing a name prefix.
Apache Syncope disclosed CVE-2026-73236, an important-rated incorrect authorization vulnerability. Delegated administration checks are enforced via Realm hierarchy prefix matches, so two sibling Realms whose names begin with the same string cannot be correctly distinguished, allowing delegated admins to act outside their assigned Realm. The flaw affects Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Users should upgrade to fixed versions.
- Prefix-based Realm matching lets sibling Realms with same-prefix names bypass authorization
- Delegated administrators can escape their assigned Realm boundaries
- Affects Syncope 3.0.x, 4.0.x, and 4.1.x release lines
- Rated important by the Apache Syncope project
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-73236 | Cross-Realm Authorization Bypass in Apache Syncope Delegated Administration | 7.5 | — |
From the original article
Posted by Francesco Chicchiriccò on Sep 14 Severity: important Affected versions: - Apache Syncope 3. 0. 0-M0 through 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.