CVE-2026-73236: Apache Syncope: Cross-Realm authorization bypass in delegated administration
Incorrect Authorization vulnerability in Apache Syncope.
Delegated administration security checks are based on Realm hierarchy and enforced via prefix matches. Due to incorrect implementation, two sibling Realms whose names begin with the same string cannot be correctly distinguished, resulting in incorrect authorization.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2.
Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.0.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.1.3
Event History
Frequently Asked Questions
Which deployments are exposed to cross-Realm authorization errors?
Deployments running Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, or 4.1.0-M0 through 4.1.2 are affected. The issue is relevant where delegated administration is used with sibling Realms whose names begin with the same string.
What configuration condition is needed for the authorization bypass to occur?
The affected Realms must be siblings in the Realm hierarchy and have names sharing the same prefix. Under that condition, prefix-based delegated-administration checks can fail to distinguish the two Realms correctly.
What is the recommended remediation?
Upgrade Apache Syncope to version 4.0.8 or 4.1.3, which fix the authorization issue.