Is CVE-2026-113511 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-113511 being exploited in the wild.

How severe is CVE-2026-113511?

Informational severity, published 2 November 2026.

Which products and versions are affected?

Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, 4.1.0-M0 through 4.1.3.

Is there a fix for CVE-2026-113511?

Yes: fixed in Syncope 4.0.9, 4.1.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-113511 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-113511?

Check whether you run Apache Syncope at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-113511: Apache Syncope authorization bypass in realm relocation

CVE-2026-113511 · Severity: info · Published 2026-11-02

Apache Syncope is an identity management platform that organizations use to manage users, roles, and administrative boundaries. A delegated administrator can exploit an authorization flaw to move user and permission data (Realm subtrees) across security boundaries that they should not have access to, potentially granting themselves or others unintended administrative privileges.

Technologies: Apache Syncope. Vendors: Apache.

Quick answers

Is CVE-2026-113511 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-113511 being exploited in the wild.
How severe is CVE-2026-113511?: Informational severity, published 2 November 2026.
Which products and versions are affected?: Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, 4.1.0-M0 through 4.1.3.
Is there a fix for CVE-2026-113511?: Yes: fixed in Syncope 4.0.9, 4.1.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-113511 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-113511?: Check whether you run Apache Syncope at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Syncope 4.0.9, 4.1.4

Technical details

A delegated administrator can relocate a Realm subtree across administrative realm boundaries without proper authorization checks on the destination realm. The vulnerability stems from insufficient validation of administrative permissions before allowing cross-boundary operations. This is a privilege escalation issue affecting versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, and 4.1.0-M0 through 4.1.3.

Affected products

Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, 4.1.0-M0 through 4.1.3

Timeline

2026-11-02: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.