Improper Privilege Management in Apache Syncope
CVE-2026-110535

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Syncope
Vendor
CVE Published:
2 November 2026

What is CVE-2026-110535?

A vulnerability in Apache Syncope allows non-administrative users to configure impersonation for web application surrogate authentication through AuthProfile self-updates. This allows unauthorized access which could compromise application security. It is crucial for users to upgrade to versions 4.0.9 or 4.1.4 to mitigate this issue.

Affected Version(s)

Apache Syncope 3.0.12 <= 3.0.16

Apache Syncope 4.0.0-M0 <= 4.0.8

Apache Syncope 4.1.0-M0 <= 4.1.3

References

https://lists.apache.org/thread.html/25vbq0pvj8svk8gl8pjl...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yallea
.