CVE-2026-73579
Deferred Deferred - Pending Action

Incorrect Authorization in Apache Syncope

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: Apache Software Foundation

Description
Incorrect Authorization vulnerability in Apache Syncope. Any search requests are transformed into SQL, Neo4J or Elasticsearch / Opensearch queries, depending on the actual deployment configuration. An important component of such transformation is the Realms filter, which ensures that the search results are matching the requester's permissions. For non-recursive search requests it is possible that such Realms filter is rendered as empty, thus voiding any restriction on requester privileges. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-73579
EUVD
EUVD-2026-77462

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
apache syncope From 3.0.0-M0 (inc) to 3.0.16 (inc)
apache syncope From 4.0.0-M0 (inc) to 4.0.7 (inc)
apache syncope From 4.1.0-M0 (inc) to 4.1.2 (inc)
apache syncope 4.0.8
apache syncope 4.1.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Incorrect Authorization vulnerability in Apache Syncope where non-recursive search requests may bypass permission restrictions due to an empty Realms filter. This allows unauthorized access to data by voiding privilege checks.

Detection Guidance

This vulnerability involves incorrect authorization in Apache Syncope where search requests may bypass permission restrictions due to an empty Realms filter. Detection requires checking Apache Syncope versions and verifying if search requests are properly filtered by realms. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to access sensitive data they are not authorized to view by sending specially crafted search requests that bypass permission filters.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating compliance requirements for data protection and access controls in standards like GDPR and HIPAA.

Mitigation Strategies

Upgrade Apache Syncope to version 4.0.8, 4.1.3, or later to fix the Incorrect Authorization vulnerability. This addresses the issue where non-recursive search requests may bypass permission restrictions due to an empty Realms filter.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73579. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart