9.8
CVE-2026-77181
- EPSS 0.48%
- Veröffentlicht 14.09.2026 12:48:01
- Zuletzt bearbeitet 14.09.2026 20:58:48
- Erkennungen
Apache Syncope: ClientApp update entitlement not effective
Incorrect Authorization vulnerability in Apache Syncope. An administrator with ClientApp's update entitlement is unable to perform the related operation, while ClientApp's create entitlement is checked both for create and update operations on ClientApp. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerApache Software Foundation
≫
Produkt
Apache Syncope
Default Statusunaffected
Version <=
3.0.16
Version
3.0.0-M0
Status
affected
Version <=
4.0.7
Version
4.0.0-M0
Status
affected
Version <=
4.1.2
Version
4.1.0-M0
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.48% | 0.399 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| CISA-ADP | 9.8 | 3.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
CWE-863 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
https://lists.apache.org/thread/swqj31jhbz7hmmkjy42461zp9rhh9lwy
http://www.openwall.com/lists/oss-security/2026/09/14/16