CVE-2026-110535: Apache Syncope: AuthProfile value escalation via self-service update

Published Nov 2, 2026

Updated

Improper Privilege Management vulnerability in Apache Syncope.

AuthProfile self-updates allow non-admin users to configure impersonation for WA surrogate authentication. This issue affects Apache Syncope: from 3.0.12 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3.

Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.

Event History

Nov 2, 2026

CVE Published

via NVD·02:17 PM

Data Sourced

via NVD·02:17 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Apache Syncope deployments running versions 3.0.12 through 3.0.16, 4.0.0-M0 through 4.0.8, or 4.1.0-M0 through 4.1.3 are affected.

What access does an attacker need?

An attacker needs a non-administrator user account that can perform an AuthProfile self-update. The issue allows that user to configure impersonation for WA surrogate authentication.

What should teams do to remediate the issue?

Upgrade to Apache Syncope 4.0.9 or 4.1.4, which fix the vulnerability.

CVE-2026-110535: Apache Syncope: AuthProfile value escalation via self-service update

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What access does an attacker need?

What should teams do to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What access does an attacker need?

What should teams do to remediate the issue?