7.5
CVE-2026-73236
- EPSS 0.34%
- Veröffentlicht 14.09.2026 13:23:17
- Zuletzt bearbeitet 14.09.2026 20:58:48
- Erkennungen
Apache Syncope: Cross-Realm authorization bypass in delegated administration
Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks are based on Realm hierarchy and enforced via prefix matches. Due to incorrect implementation, two sibling Realms whose names begin with the same string cannot be correctly distinguished, resulting in incorrect authorization. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerApache Software Foundation
≫
Produkt
Apache Syncope
Default Statusunaffected
Version <=
3.0.16
Version
3.0.0-M0
Status
affected
Version <=
4.0.7
Version
4.0.0-M0
Status
affected
Version <=
4.1.2
Version
4.1.0-M0
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.34% | 0.267 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| CISA-ADP | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
|
CWE-863 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
https://lists.apache.org/thread/5m8t357n2xt38ym5l2rrgbjyztd97yjv
http://www.openwall.com/lists/oss-security/2026/09/14/7