Executive brief
Apache Syncope is a unified Identity and Access Management system that handles user provisioning and authentication. A flaw in its search query filtering mechanism can allow attackers to bypass authorization controls and access data they should not be permitted to view, potentially exposing sensitive user information and administrative functions.
Technical details
An incorrect authorization vulnerability exists in Apache Syncope's realm filtering mechanism. Search requests are transformed into SQL, Neo4J, or Elasticsearch/OpenSearch queries depending on deployment configuration; the Realms filter is responsible for restricting results based on user permissions. For non-recursive search requests, this filter can be rendered empty, voiding authorization checks entirely. An attacker can craft search requests to bypass permission restrictions and access unauthorized data. The issue affects versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2; patches are available in versions 4.0.8 and 4.1.3.
Affected products
- Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, 4.1.0-M0 through 4.1.2
Timeline
- 2026-09-14: disclosed
- 2026-09-14: patched: Fixed in versions 4.0.8 and 4.1.3