CVE-2026-73668

Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values

Published Sep 14, 2026 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Description

Incorrect Authorization vulnerability in Apache Syncope.

An administrator with adequate entitlements in a given Realm may be able to read via REST the full Connector configuration, confidential properties included, scoped in another Realm and thus be able to effectively duplicate such Connector instance into the Realm they have administration rights for.

This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2.

Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

Analysis

Technical impact

The bug is an incorrect authorization check that allows an administrator with sufficient entitlements in one realm to use the REST API to read a connector’s full configuration for another realm. The configuration contains confidential properties, enabling the attacker to duplicate the connector instance in a realm where they already have administrative rights. The consequence is the exposure of confidential data and potential circumvention of realm isolation, risking data integrity and confidentiality across the system.

Affected Systems

The issue affects all Apache Syncope instances from 3.0.0‑M0 through 3.0.16, 4.0.0‑M0 through 4.0.7, and 4.1.0‑M0 through 4.1.2. Administrators using these versions should be aware that cross‑realm access to Connector configuration is possible.

Risk and Exploitability

The CVSS score is 9.8, indicating critical severity. EPSS is < 1%, suggesting exploit probability is low, and the vulnerability is not listed in the CISA KEV catalog. Attackers require administrative entitlements in at least one realm and the ability to invoke the Syncope REST API; the vulnerability does not rely on external network exposure or additional software prerequisites. Based on the description the primary attack vector is an internal administrator with cross‑realm privileges, but the flaw could be leveraged by any user who obtains such privileges.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apache Software Foundation

Apache Syncope

unaffected

Version	Status	Constraints
`3.0.0-M0`	affected	≤ 3.0.16
`4.0.0-M0`	affected	≤ 4.0.7
`4.1.0-M0`	affected	≤ 4.1.2

No data.

Vendor Product Versions

Apache

Syncope

Version	Status	Scheme	Platform
`[3.0.0-M0,3.0.16]`	affected	semver	—
`[4.0.0-M0,4.0.7]`	affected	semver	—
`[4.1.0-M0,4.1.2]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Apache Syncope to version 4.0.8, 4.1.3, or a later release that includes the authorization fix.
Restrict or disable the REST API endpoint that exposes connector configuration settings in realms where it is not required, limiting exposure of confidential properties.
Audit and tighten role‑based access control so that administrative roles are scoped to the appropriate realms and remove any overly permissive cross‑realm privileges.
Monitor access logs for unexpected read operations against connector configuration endpoints and investigate anomalies promptly.

Generated by OpenCVE AI on September 21, 2026 at 00:40 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.512% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
http://www.openwall.com/lists/oss-security/2026/09/14/11
https://lists.apache.org/thread/4lgsbbgc72mngf6mc1q5b1cj3d9nyphn

History

Nov 10, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 14, 2026 9:00 PM First appearance in the feed. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Apache Apache syncope
Vendors & Products		Apache Apache syncope
References		http://www.openwall.com/lists/oss-security/2026/09/14/11
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sep 14, 2026 1:00 PM Description updated. Title updated. Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Description		Incorrect Authorization vulnerability in Apache Syncope. An administrator with adequate entitlements in a given Realm may be able to read via REST the full Connector configuration, confidential properties included, scoped in another Realm and thus be able to effectively duplicate such Connector instance into the Realm they have administration rights for. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
Title		Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values
Weaknesses		CWE-863
References		https://lists.apache.org/thread/4lgsbbgc72mngf6mc1q5b1cj3d9nyphn