The vulnerability permits a delegated administrator to move a realm subtree across administrative boundaries without authorization. By manipulating a user‑controlled key, the attacker bypasses the intended scope of their privileges, allowing unauthorized relocation of realms. This privilege escalation can expose sensitive data stored under the affected realm or enable further administrative actions that should be restricted.

The affected product is Apache Syncope from the Apache Software Foundation. Versions affected include 3.0.0‑M0 through 3.0.16, 4.0.0‑M0 through 4.0.8, and 4.1.0‑M0 through 4.1.3. Users are advised to upgrade to at least version 4.0.9 or 4.1.4, which contain the fix.

Because the CVSS and EPSS scores are not provided, the exact quantitative risk is unknown; however, the vulnerability enables a serious privilege escalation that can be exploited by any delegated administrator. External exploitation would require the attacker to obtain or compromise such a role. The risk remains high for environments where delegated administrators have broad permissions, and there is no KEV listing indicating current exploitation. The likely attack vector involves an attacker who either masquerades as or compromises a delegated administrator to re‑locate realm subtrees.