Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitymedium

Apache Syncope discloses three cross-Realm authorization vulnerabilities: CVE-2026-73236, CVE-2026-73370, and CVE-2026-73668

1 source · 2 articlesFirst reported Updated ()1 · 1 read
What's new

A new report adds CVE-2026-73668, a third moderate-rated incorrect-authorization vulnerability in which administrators can read confidential ConnId bundle configuration values from realms outside their entitlements, expanding the story from two to three same-day Syncope disclosures sharing identical affected version ranges.

Merged summary · glm-5.3 · rewritten as coverage arrivesSummaries by Vani AI

Three incorrect-authorization flaws in Apache Syncope's delegated administration let users cross Realm boundaries: a prefix-matching bypass (important), a reconciliation bypass (moderate), and disclosure of confidential ConnId bundle configuration values from…

On 2026-09-14, the Apache Syncope project disclosed three related incorrect authorization vulnerabilities in its delegated administration feature, all affecting the same version ranges: Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. CVE-2026-73236, rated important, arises because delegated administration checks are enforced via Realm hierarchy prefix matches: two sibling Realms whose names begin with the same string cannot be correctly distinguished, allowing delegated administrators to act outside their assigned Realm. CVE-2026-73370, rated moderate and residing in the syncope-core-idm-logic module, allows reconciliation actions to bypass cross-Realm delegated administration security checks. CVE-2026-73668, also rated moderate and affecting syncope-core-idm-logic, allows an administrator with entitlements in one realm to view confidential ConnId bundle configuration values belonging to other realms. The recommended remediation for all three issues is upgrading to the latest fixed releases; the disclosures do not state specific fixed version numbers.

Key facts
  • CVE-2026-73236: important-rated incorrect authorization flaw; Realm hierarchy prefix matching cannot distinguish sibling Realms sharing a name prefix, letting delegated admins act outside their assigned Realm
  • CVE-2026-73370: moderate-rated incorrect authorization flaw in syncope-core-idm-logic; reconciliation actions can bypass cross-Realm delegated administration security checks
  • CVE-2026-73668: moderate-rated incorrect authorization flaw in syncope-core-idm-logic; administrators with entitlements in one realm can view confidential ConnId bundle configuration values of other realms
  • All three CVEs affect Syncope 3.0.0-M0–3.0.16, 4.0.0-M0–4.0.7, and 4.1.0-M0–4.1.2
  • Remediation for all three is upgrading to the latest fixed releases; no specific fixed version numbers were stated in the disclosures
  • All three disclosed via oss-security on 2026-09-14
Analyze CVE-2026-73236 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-73236CVE-2026-73370CVE-2026-73668

Coverage

oldest first · one row per article · UTC
  1. · Sep 14, 2026 oss-securityFirst report

    CVE-2026-73236: Apache Syncope: Cross-Realm authorization bypass in delegated administration

    Apache Syncope CVE-2026-73236 bypasses delegated administration checks for sibling Realms sharing a name prefix.

  2. · Sep 14, 2026 oss-security

    CVE-2026-73370: Apache Syncope: Cross-Realm boundaries reconciliation bypass

    Apache Syncope CVE-2026-73370 allows reconciliation actions to bypass cross-Realm delegated administration boundaries.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-73370
+2 related CVEs
CVE-2026-73668CVE-2026-73236
Broken Authorization in Apache Syncope Reconciliation Bypasses Delegated-Admin Entitlements
9.8
group max
—