# CVE-2026-110535: Apache Syncope privilege escalation via AuthProfile self-update

Source: https://junglewise.ai/threats/cve-2026-110535-improper-privilege-management-vulnerability-in-apache-syncope  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-02. Updated: 2026-11-02  
License: CC BY 4.0 with a link back

CVE-2026-110535 · Severity: info · Published 2026-11-02

Apache Syncope is an identity and access management platform that manages user authentication and authorization. A vulnerability in how users can update their own authentication profile allows non-administrative users to enable account impersonation features, potentially letting them masquerade as other users including administrators. This could lead to unauthorized access to sensitive data or administrative functions.

Technologies: [Apache Syncope](https://junglewise.ai/threats/technologies/apache-syncope). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-110535 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110535 being exploited in the wild.

**How severe is CVE-2026-110535?** Informational severity, published 2 November 2026.

**Which products and versions are affected?** Apache Syncope 3.0.12 through 3.0.16, 4.0.0-M0 through 4.0.8, 4.1.0-M0 through 4.1.3.

**Is there a fix for CVE-2026-110535?** Yes: fixed in 4.0.9, 4.1.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-110535 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-110535?** Check whether you run Apache Syncope at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.0.9, 4.1.4

## Technical details

The vulnerability is an improper privilege management issue in AuthProfile self-update functionality. Non-admin users can modify their own authentication profile to enable WA surrogate authentication (account impersonation), a privilege that should be restricted to administrators. An authenticated attacker with a regular user account can exploit this by modifying their profile directly, gaining the ability to impersonate other users without requiring admin rights.

## Affected products

- Apache Syncope 3.0.12 through 3.0.16, 4.0.0-M0 through 4.0.8, 4.1.0-M0 through 4.1.3

## Timeline

- 2026-11-02: disclosed

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://lists.apache.org/thread.html/25vbq0pvj8svk8gl8pjld1j0nzrdxy26](https://lists.apache.org/thread.html/25vbq0pvj8svk8gl8pjld1j0nzrdxy26)

## Related threats

- [Apache Syncope SQL injection in event parameters](https://junglewise.ai/threats/cve-2026-114364-improper-neutralization-of-special-elements-used-in-an-sql)
- [Apache Syncope improper sandbox isolation in Groovy](https://junglewise.ai/threats/cve-2026-113687-improper-isolation-or-compartmentalization-vulnerability-in)
- [Apache Syncope authorization bypass in realm relocation](https://junglewise.ai/threats/cve-2026-113511-authorization-bypass-through-user-controlled-key-vulnerability)
- [Apache Syncope arbitrary code execution via BPMN JUEL expressions](https://junglewise.ai/threats/cve-2026-109083-improper-isolation-or-compartmentalization-vulnerability-in)
- [Apache Syncope's AES encryption stores hard-coded passwords in internal database](https://junglewise.ai/threats/cve-2025-65998-apache-syncope-s-aes-encryption-stores-hard-coded-passwords-in)