CVE-2026-73236
Deferred Deferred - Pending Action

Incorrect Authorization in Apache Syncope Due to Realm Prefix Matching

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: Apache Software Foundation

Description
Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks are based on Realm hierarchy and enforced via prefix matches. Due to incorrect implementation, two sibling Realms whose names begin with the same string cannot be correctly distinguished, resulting in incorrect authorization. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-73236
EUVD
EUVD-2026-77474

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
apache syncope From 3.0.0-M0 (inc) to 3.0.16 (inc)
apache syncope From 4.0.0-M0 (inc) to 4.0.7 (inc)
apache syncope 4.0.8
apache syncope 4.1.3
apache syncope From 4.1.0-M0 (inc) to 4.1.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Incorrect Authorization vulnerability in Apache Syncope where security checks rely on Realm hierarchy using prefix matches. Due to flawed implementation, sibling Realms with names starting with the same string cannot be properly distinguished, leading to incorrect authorization decisions.

Detection Guidance

This vulnerability is specific to Apache Syncope's authorization mechanism and cannot be detected using general network or system commands. Review Syncope logs for authorization failures between sibling realms with similar prefixes. Check Syncope version against affected ranges (3.0.0-M0 to 3.0.16, 4.0.0-M0 to 4.0.7, 4.1.0-M0 to 4.1.2).

Impact Analysis

An attacker could exploit this to gain unauthorized access to resources or perform actions they shouldn't be permitted to, potentially leading to data breaches or system compromise. The impact depends on the privileges of the misconfigured Realms.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected versions may fail compliance audits due to inadequate access controls.

Mitigation Strategies

Upgrade Apache Syncope to version 4.0.8, 4.1.3, or later to fix the incorrect authorization issue. Affected versions are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73236. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart