Apache Syncope allows a user with delegation creation rights to assign roles that are not owned by that user or that belong to other Realm subtrees. This flaw is an example of improper privilege management (CWE‑269). An attacker who can create or update delegations could grant themselves or other accounts high‑privilege roles, enabling unrestricted access to protected resources and potentially full administrative control of the system.

Apache Software Foundation’s Apache Syncope versions 3.0.0‑M0 through 3.0.16, 4.0.0‑M0 through 4.0.7, and 4.1.0‑M0 through 4.1.2 are vulnerable. The official fix is to upgrade to version 4.0.8 or later, or 4.1.3 or later.

The CVSS score of 9.8 indicates critical severity. The EPSS score is below 1 %, meaning that, at the time of analysis, the probability of exploitation in the wild is low but not zero. This vulnerability is not listed in CISA’s KEV catalog, so there is no known mass exploitation campaign. The attack requires an attacker who already has delegation rights via the web interface, API, or administrative console. The likely attack vector is either through the Syncope management console or the public REST API, which creation of delegations with arbitrary roles, privilege escalation to system or higher can be achieved without additional credentials.