The bug is an incorrect authorization check that allows an administrator with sufficient entitlements in one realm to use the REST API to read a connector’s full configuration for another realm. The configuration contains confidential properties, enabling the attacker to duplicate the connector instance in a realm where they already have administrative rights. The consequence is the exposure of confidential data and potential circumvention of realm isolation, risking data integrity and confidentiality across the system.

The issue affects all Apache Syncope instances from 3.0.0‑M0 through 3.0.16, 4.0.0‑M0 through 4.0.7, and 4.1.0‑M0 through 4.1.2. Administrators using these versions should be aware that cross‑realm access to Connector configuration is possible.

EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, so the current exploitation probability and CWE‑863, an improper authorization flaw. Attackers require administrative entitlements in at least one realm and the ability to invoke the Syncope REST API; the vulnerability does not rely on external network exposure or additional software prerequisites. Based on the description the primary attack vector is an internal administrator with cross‑realm privileges, but the flaw could be leveraged by any user who obtains such privileges.