CVE-2026-78330: Apache Syncope: Privilege escalation for admin user via JWT authentication
Incorrect privilege assignment vulnerability in Apache Syncope.
When the configured JWKS settings for internal JWT authentication are disclosed (at least protocol and key), an attacker can obtain admin privileges after completing a successful authentication and obtaining a valid low-privileges JWT.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2.
Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Syncopeto a version that resolves this vulnerability.Fixed in 4.0.8 - Upgrade
Upgrade
Apache Syncopeto a version that resolves this vulnerability.Fixed in 4.1.3 - Compensating control
Limit disclosure of the internal JWT authentication JWKS settings (at least the protocol and key).
Event History
Frequently Asked Questions
What must an attacker obtain before they can escalate privileges?
The attacker needs the configured JWKS settings used for internal JWT authentication, including at least the protocol and key. They must also successfully authenticate and obtain a valid JWT for a low-privileged account.
Are unauthenticated attackers able to exploit this issue?
The described attack requires successful authentication and a valid low-privilege JWT, so authentication is required. Disclosure of the internal JWT JWKS configuration is also necessary.
Which releases contain the fix?
The issue is fixed in Apache Syncope 4.0.8 and 4.1.3. Affected release ranges include 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.