Executive brief
Apache Syncope is an identity and access management platform that manages user accounts and permissions across organizations. Due to a flaw in how it validates administrator permissions based on organizational hierarchy (Realms), administrators with limited access to one organizational branch can incorrectly gain access to a sibling branch if their names start with the same characters. This bypasses delegated administration controls and allows unauthorized account and permission manipulation.
Technical details
The vulnerability is an incorrect authorization flaw in Syncope's delegated administration module. Security checks for Realm hierarchy are enforced using prefix-matching logic, but the implementation fails to properly distinguish between sibling Realms whose names begin with the same string (e.g., "Realm1" vs "Realm1_Branch"). An authenticated administrator with delegated permissions can exploit this to access and modify resources in unintended sibling Realms by leveraging the prefix-matching bypass. The attack requires valid administrator credentials and knowledge of Realm naming conventions, but no network-level authentication beyond the application. Fixes are available in Syncope 4.0.8, 4.1.3, and later versions.
Affected products
- Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, 4.1.0-M0 through 4.1.2
Timeline
- 2026-09-14: disclosed