ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “delegation”

3 stories in the last 3d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllAI safety & security 8AI industry 3Vulnerability 3Advisory 3AI research 2AI tools & infra 2Model release 1
SeverityAllcritical 0high 2medium 4low 0info 16

CVE-2026-73470: Apache Syncope: Delegating users can grant unowned Roles

Apache Syncope CVE-2026-73470 lets delegated users grant roles they do not own via crafted delegations.

Apache Syncope disclosed CVE-2026-73470, an improper privilege management vulnerability rated important. Delegations can be created or updated so that delegated users are able to grant roles they do not own, breaking ownership constraints. The flaw affects syncope-core-provisioning-java in versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Users are advised to upgrade to the latest fixed releases.

oss-security · 2d agoVulnerabilityCVE-2026-73470

CVE-2026-73236: Apache Syncope: Cross-Realm authorization bypass in delegated administration

Apache Syncope CVE-2026-73236 bypasses delegated administration checks for sibling Realms sharing a name prefix.

Apache Syncope disclosed CVE-2026-73236, an important-rated incorrect authorization vulnerability. Delegated administration checks are enforced via Realm hierarchy prefix matches, so two sibling Realms whose names begin with the same string cannot be correctly distinguished, allowing delegated admins to act outside their assigned Realm. The flaw affects Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Users should upgrade to fixed versions.

oss-security · 2d agoVulnerability 3 sourcesCVE-2026-732361

Spain gets its first taste of AI-aided cyber attack

Spain's AEPD reports the country's first data breach executed by an autonomous AI agent that scanned files and exploited vulnerabilities to access personal data.

Spain's data protection agency AEPD reported the country's first personal data breach caused by an autonomous AI agent powered by a known large language model. The agent scanned generic files, accessed the organization's system, and ran vulnerability scans to gain read/write access to files containing personal data and invoices. AEPD president Francisco Pérez Bes called for an immediate review of security and data protection models, noting the agency received a record 30,931 complaints in 2025, up 64% year-over-year.

The Register · Security · 19h agoAI safety & security in the wild1