CVE-2026-78330: Apache Syncope: Privilege escalation for admin user via JWT authentication
Incorrect privilege assignment vulnerability in Apache Syncope.
When the configured JWKS settings for internal JWT authentication are disclosed (at least protocol and key), an attacker can obtain admin privileges after completing a successful authentication and obtaining a valid low-privileges JWT.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2.
Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Syncopeto a version that resolves this vulnerability.Fixed in 4.0.8 / 4.1.3 - Compensating control
If internal JWT authentication JWKS settings are disclosed (at least protocol and key), treat this as compromised: restrict/rotate access to the JWKS configuration so attackers cannot obtain or use the disclosed protocol/key to mint valid JWTs.
Event History
Frequently Asked Questions
What must an attacker obtain before they can escalate privileges?
The attacker needs the configured JWKS settings used for internal JWT authentication, including at least the protocol and key. They must also successfully authenticate and obtain a valid JWT for a low-privileged account.
Are unauthenticated attackers able to exploit this issue?
The described attack requires successful authentication and a valid low-privilege JWT, so authentication is required. Disclosure of the internal JWT JWKS configuration is also necessary.
Which releases contain the fix?
The issue is fixed in Apache Syncope 4.0.8 and 4.1.3. Affected release ranges include 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.