Authorization Bypass Vulnerability in Apache Syncope
CVE-2026-113511

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Syncope
Vendor
CVE Published:
2 November 2026

What is CVE-2026-113511?

A vulnerability in Apache Syncope allows a delegated administrator to bypass authorization controls, enabling them to move a Realm subtree across administrative boundaries without the necessary permissions. This could lead to unauthorized access and potential security breaches. Users are advised to update to version 4.0.9 or 4.1.4 to mitigate this issue.

Affected Version(s)

Apache Syncope 3.0.0-M0 <= 3.0.16

Apache Syncope 4.0.0-M0 <= 4.0.8

Apache Syncope 4.1.0-M0 <= 4.1.3

References

https://lists.apache.org/thread.html/gn7y6k37xgody4wt4o98...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Muted Cybersecurity
.