Executive brief
Apache Syncope is an open-source identity and access management system used to manage user accounts and permissions. A privileged administrator can exploit a REST API vulnerability to view all active access tokens, including their cryptographic signatures, then reuse those tokens to impersonate higher-privileged users and perform unauthorized administrative actions. This could lead to complete compromise of user identity data and system administration capabilities.
Technical details
This vulnerability is an information disclosure and privilege escalation issue in Apache Syncope's REST API. An administrator with sufficient entitlements can call REST endpoints to enumerate all existing access tokens and retrieve their signed JWT bodies, which normally should be hidden. An attacker can then use these JWT tokens to authenticate subsequent REST requests and impersonate users with higher privilege levels. The vulnerability affects Syncope 3.0.0 through 3.0.16, 4.0.0 through 4.0.7, and 4.1.0 through 4.1.2. Patches are available in versions 4.0.8 and 4.1.3. The attack requires valid administrator credentials but does not require network privileges beyond normal REST API access.
Affected products
- Apache Syncope 3.0.0 through 3.0.16, 4.0.0 through 4.0.7, 4.1.0 through 4.1.2
Timeline
- 2026-09-14: disclosed
- 2026-09-14: patched: Patches available in versions 4.0.8 and 4.1.3