Apache Syncope discloses three cross-Realm authorization vulnerabilities: CVE-2026-73236, CVE-2026-73370, and CVE-2026-73668

Apache Syncope, an open-source identity management platform, enforces delegated administration entitlements by checking whether a target object's Realm sits under an administrator's assigned Realm, using prefix matches on realm names. Due to an incorrect implementation (CWE-863), two sibling Realms whose names begin with the same string cannot be distinguished, so a delegated administrator for one Realm can effectively act on objects in the other Realm. An authenticated attacker holding delegated-administrator rights over one realm gains unauthorized access to users, groups, and other managed objects in the sibling realm — a horizontal privilege escalation between administrative domains. Affected deployments are Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2; fixes ship in 4.0.8 and 4.1.3, with no patched 3.0.x release listed. No public proof of concept is known, the issue is not in CISA's KEV, and there is no indication of exploitation in the wild.

Do: Upgrade to Apache Syncope 4.0.8 or 4.1.3 as soon as possible; 3.0.x has no fixed release, so deployments on that line must migrate to a patched 4.x version. Until patched, avoid sibling Realm names that share a leading string and review delegated-administration assignments for realms whose names could collide. Audit Syncope logs for delegated administrators performing operations on realms outside their assigned scope.

Apache Syncope, an open-source identity management (IdM) platform, contains an incorrect authorization flaw (CWE-863) in the Reconciliation service: the delegated-administration security checks applied to its pull and push operations are incomplete. As a result, an administrator account that was never granted the required entitlements can still invoke reconciliation pull and push actions, which synchronize identities across realms and connected resources — enabling reconciliation to be triggered across realm boundaries beyond that admin's delegated scope. This can let an under-privileged or rogue delegated administrator read or alter identity data (users, groups, accounts on connected systems) outside the realm they administer. Affected versions are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2; fixes are available in 4.0.8 and 4.1.3, with no fixed 3.0.x release listed. The issue has no CVSS score yet, is not in the CISA KEV catalog, and there is no known public PoC or evidence of in-the-wild exploitation.

Do: Upgrade immediately to Apache Syncope 4.0.8 or 4.1.3; organizations still on the 3.0.x line must upgrade to a fixed 4.x release since no 3.0 fix was published. Restrict access to the Reconciliation service (pull/push) so only fully entitled administrators can invoke it, and audit logs for pull/push executions initiated by delegated administrators who lacked the corresponding entitlements. Investigate any resulting cross-realm identity changes or unexpected synchronizations to connected resources.

Apache Syncope, an open-source identity and access management (IdM) platform, contains an incorrect authorization flaw (CWE-863) in its REST API that lets an authenticated administrator who has full entitlements in one Realm read the complete Connector configuration scoped to a different Realm — including confidential properties such as the credentials used to bind to connected external resources (e.g., LDAP/AD, databases) via ConnId connector bundles. The attacker gains those secrets and can effectively clone the Connector instance into their own Realm, giving them working credentials for the target Realm's backend systems and enabling lateral movement outside their delegated administrative scope. The issue affects Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2; it is fixed in 4.0.8 and 4.1.3 (the 3.0.x line has no listed fix, so those users must upgrade to a fixed 4.x release). Exploitation requires an already-privileged internal account, so the risk is primarily privilege escalation across realm boundaries by semi-trusted or compromised tenant administrators. No CVSS score has been assigned, it is not in the CISA KEV catalog, and no public proof of concept or known in-the-wild exploitation exists.

Do: Upgrade Apache Syncope to 4.0.8 or 4.1.3; deployments still on the 3.0.x line (up to 3.0.16) have no fixed 3.0.x release and should migrate to a fixed 4.x version. Until patched, minimize the number of realm-scoped administrators, review REST access logs for any admin reading Connector configurations outside their own Realm, and rotate the credentials stored in Connector confidential properties (e.g., LDAP/AD and database bind accounts) since they may have been readable cross-realm.