Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Apache Syncope allows unauthorized role delegation

CVE-2026-73470 · published 11 days ago
Summary

In certain versions of Apache Syncope, a user can create or change delegations that assign roles they do not own or that belong to a different part of the system. This could let someone grant themselves or others more permissions than intended. Upgrade to version 4.0.8 or 4.1.3 (or later) to close the gap.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
apache software foundation apache syncope <= 3.0.16
Original advisory text
Improper Privilege Management vulnerability in Apache Syncope. Delegations can be created or updated with Roles not owned by the delegating User, or not for the same Realm subtree under the de...
Improper Privilege Management vulnerability in Apache Syncope.





Delegations can be created or updated with Roles not owned by the delegating User, or not for the same Realm subtree under the delegation management was granted for.



This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2.


Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
References
Severity
9.8 Critical
Exploitation
EPSS <1%
Type
CWE-269Improper Privilege Management
Timeline
Published14 Sep 2026
Updated25 Sep 2026
First seen14 Sep 2026
Sources
CVE-2026-73470 · NVD
CVE-2026-73470 · MITRE
Track software like this
Free during beta