Authorization Flaw in Apache Syncope Impacts Multiple Versions
CVE-2026-77181
Currently unrated
What is CVE-2026-77181?
An incorrect authorization vulnerability exists in Apache Syncope that prevents users with update privileges on ClientApp from executing the intended operations. Specifically, while ClientApp's create entitlement grants permissions for creation, it improperly applies the same for update operations, leading to potential security breaches. Affected users are urged to upgrade to version 4.0.8 or 4.1.3 to address this issue effectively.
Affected Version(s)
Apache Syncope 3.0.0-M0 <= 3.0.16
Apache Syncope 4.0.0-M0 <= 4.0.7
Apache Syncope 4.1.0-M0 <= 4.1.2