# CVE-2026-113511: Apache Syncope authorization bypass in realm relocation

Source: https://junglewise.ai/threats/cve-2026-113511-authorization-bypass-through-user-controlled-key-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-02. Updated: 2026-11-02  
License: CC BY 4.0 with a link back

CVE-2026-113511 · Severity: info · Published 2026-11-02

Apache Syncope is an identity management platform that organizations use to manage users, roles, and administrative boundaries. A delegated administrator can exploit an authorization flaw to move user and permission data (Realm subtrees) across security boundaries that they should not have access to, potentially granting themselves or others unintended administrative privileges.

Technologies: [Apache Syncope](https://junglewise.ai/threats/technologies/apache-syncope). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-113511 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-113511 being exploited in the wild.

**How severe is CVE-2026-113511?** Informational severity, published 2 November 2026.

**Which products and versions are affected?** Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, 4.1.0-M0 through 4.1.3.

**Is there a fix for CVE-2026-113511?** Yes: fixed in Syncope 4.0.9, 4.1.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-113511 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-113511?** Check whether you run Apache Syncope at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Syncope 4.0.9, 4.1.4

## Technical details

A delegated administrator can relocate a Realm subtree across administrative realm boundaries without proper authorization checks on the destination realm. The vulnerability stems from insufficient validation of administrative permissions before allowing cross-boundary operations. This is a privilege escalation issue affecting versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, and 4.1.0-M0 through 4.1.3.

## Affected products

- Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, 4.1.0-M0 through 4.1.3

## Timeline

- 2026-11-02: disclosed

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://lists.apache.org/thread.html/gn7y6k37xgody4wt4o981cywcovgw106](https://lists.apache.org/thread.html/gn7y6k37xgody4wt4o981cywcovgw106)

## Related threats

- [Apache Syncope SQL injection in event parameters](https://junglewise.ai/threats/cve-2026-114364-improper-neutralization-of-special-elements-used-in-an-sql)
- [Apache Syncope improper sandbox isolation in Groovy](https://junglewise.ai/threats/cve-2026-113687-improper-isolation-or-compartmentalization-vulnerability-in)
- [Apache Syncope privilege escalation via AuthProfile self-update](https://junglewise.ai/threats/cve-2026-110535-improper-privilege-management-vulnerability-in-apache-syncope)
- [Apache Syncope arbitrary code execution via BPMN JUEL expressions](https://junglewise.ai/threats/cve-2026-109083-improper-isolation-or-compartmentalization-vulnerability-in)
- [Apache Syncope's AES encryption stores hard-coded passwords in internal database](https://junglewise.ai/threats/cve-2025-65998-apache-syncope-s-aes-encryption-stores-hard-coded-passwords-in)