https://seclists.org/oss-sec/2026/q3/769: CVE-2026-78330: Apache Syncope: Privilege escalation for admin user via JWT authentication

Q: What must an attacker obtain before they can escalate privileges?

The attacker needs disclosure of the configured JWKS settings used for internal JWT authentication, including at least the protocol and key. They must also successfully authenticate and obtain a valid low-privilege JWT.

Q: Are all Syncope deployments in the listed version ranges exposed?

Exposure depends on the configured JWKS settings for internal JWT authentication being disclosed. The issue is exploitable only when those settings, at minimum the protocol and key, are available to an attacker.

Q: Which releases contain the fix?

Upgrade to Apache Syncope 4.0.8 or 4.1.3. These releases fix the incorrect privilege assignment issue.

Published Sep 14, 2026

Updated

Affected Software

3 affected components

Apache Syncope>=3.0.0-M0<=3.0.16

Apache Syncope>=4.0.0-M0<=4.0.7

Apache Syncope>=4.1.0-M0<=4.1.2

Frequently Asked Questions

What must an attacker obtain before they can escalate privileges?

The attacker needs disclosure of the configured JWKS settings used for internal JWT authentication, including at least the protocol and key. They must also successfully authenticate and obtain a valid low-privilege JWT.

Are all Syncope deployments in the listed version ranges exposed?

Exposure depends on the configured JWKS settings for internal JWT authentication being disclosed. The issue is exploitable only when those settings, at minimum the protocol and key, are available to an attacker.

Which releases contain the fix?

Upgrade to Apache Syncope 4.0.8 or 4.1.3. These releases fix the incorrect privilege assignment issue.