Executive brief
Apache Syncope is an identity and access management platform that administrators use to manage user accounts and application permissions. This vulnerability allows an attacker with ClientApp create privileges to perform unauthorized updates to ClientApp configurations, due to flawed permission checks that incorrectly apply create rules to update operations. This could allow privilege escalation and unauthorized changes to critical application settings.
Technical details
This is an authorization bypass vulnerability in Apache Syncope's ClientApp management component. The root cause is that the permission check for ClientApp update operations incorrectly uses the create entitlement instead of the proper update entitlement, allowing an attacker with create permissions to also perform update operations they should not have access to. The vulnerability requires network access to the Syncope administrative interface and an authenticated account with ClientApp create privileges. An attacker can exploit this to modify existing ClientApp configurations, leading to privilege escalation and unauthorized changes to application settings. The vulnerability affects versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Patches are available in versions 4.0.8 and 4.1.3.
Affected products
- Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, 4.1.0-M0 through 4.1.2
Timeline
- 2026-09-14: disclosed