Apache Syncope authorization bypass through User-Controlled key (CVE-2026-113511)
Delegated administrators can bypass Realm update boundaries without destination permission.
Stories per day · 30 days
2 RSS
Relatedapache2rce2authorization-bypass1bpmn1groovy1impersonation1juel1privilege-escalation1realm1sql-injection1
17 stories, newest first · one card per story
Stories tagged #syncope
CVE-2026-87802: Apache Syncope: SRA OAuth2 JWT signature verification bypass
Low-severity CVE-2026-87802 in Apache Syncope SRA allows JWT signature forgery in OAuth 2.0 setups without JWKS URI.
CVE-2026-86460: Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence
Apache Syncope's Neo4j persistence layer permits Cypher injection via certain FIQL search expressions, affecting versions through 3.0.16, 4.0.7, and 4.1.2.
CVE-2026-82232: Apache Syncope: SQL injection via sort parameter in Task search
Apache Syncope's JPA persistence layer allows SQL injection via the sort parameter in Task search, affecting all releases through 4.1.2.
CVE-2026-78336: Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user
Apache Syncope's OIDCC4UI extension leaks OIDC client secrets in the provider list to any authenticated user, versions through 4.1.2 affected.
CVE-2026-78330: Apache Syncope: Privilege escalation for admin user via JWT authentication
Apache Syncope allows privilege escalation for an admin user via misconfigured internal JWT JWKS authentication settings, versions through 4.1.2.
CVE-2026-78318: Apache Syncope: Unauthenticated reflected XSS in Console and Enduser
Apache Syncope Console and Enduser UIs suffer unauthenticated reflected XSS via notification messages, affecting versions 4.0.4 through 4.1.2.
CVE-2026-77883: Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist
Apache Syncope's JEXL template engine permits one-hop navigation past the JexlContextBuilder name denylist, enabling administrator-driven information disclosure.
CVE-2026-77181: Apache Syncope: ClientApp update entitlement not effective
Apache Syncope discloses low-severity CVE-2026-77181, an incorrect authorization flaw where the ClientApp update entitlement is not effective in versions 3.0.x through 4.1.2.
CVE-2026-75015: Apache Syncope: Nested secrets leak cleartext into audit records readable
Apache Syncope leaks nested secrets in cleartext into audit records readable by unauthorized users; affects 3.0.x, 4.0.x, and 4.1.x versions.
CVE-2026-73668: Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values
Apache Syncope cross-realm authorization flaw lets administrators read confidential ConnId bundle configuration values from realms they should not access (CVE-2026-73668).
CVE-2026-73579: Apache Syncope: Non-recursive Any search could skip Realms restrictions
Apache Syncope non-recursive Any search can skip Realms restrictions, exposing objects outside an administrator's authorized realm (CVE-2026-73579).
CVE-2026-73470: Apache Syncope: Delegating users can grant unowned Roles
Apache Syncope CVE-2026-73470 lets delegated users grant roles they do not own via crafted delegations.
CVE-2026-73236: Apache Syncope: Cross-Realm authorization bypass in delegated administration
Apache Syncope CVE-2026-73236 bypasses delegated administration checks for sibling Realms sharing a name prefix.
CVE-2026-73195: Apache Syncope: CSV export spreadsheet formula injection
Apache Syncope CVE-2026-73195 allows authenticated users to inject spreadsheet formulas into CSV exports.
CVE-2026-73191: Apache Syncope: CAS service URL injection via Forwarded HTTP headers
Apache Syncope SRA CVE-2026-73191 enables CAS service URL injection via Forwarded HTTP headers.
CVE-2026-73178: Apache Syncope: JWT Access Token takeover
Apache Syncope discloses CVE-2026-73178, an important-severity flaw enabling JWT access token takeover in versions 3.0.x through 4.1.2.