CVE-2026-77181: Apache Syncope: ClientApp update entitlement not effective
Incorrect Authorization vulnerability in Apache Syncope.
An administrator with ClientApp's update entitlement is unable to perform the related operation, while ClientApp's create entitlement is checked both for create and update operations on ClientApp.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2.
Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Syncopeto a version that resolves this vulnerability.Fixed in 4.0.8 - Upgrade
Upgrade
Apache Syncopeto a version that resolves this vulnerability.Fixed in 4.1.3
Event History
Frequently Asked Questions
Who is affected by this authorization issue?
Administrators attempting to update ClientApp objects are affected when they have the ClientApp update entitlement but do not also have the ClientApp create entitlement. The update operation incorrectly checks the create entitlement.
What access would an administrator need to update a ClientApp before applying the fix?
In affected releases, the administrator needs the ClientApp create entitlement because it is checked for both ClientApp creation and updates. The ClientApp update entitlement alone is not effective for the update operation.
Which versions should be upgraded?
Upgrade to Apache Syncope 4.0.8 or 4.1.3. Affected versions are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.