CVE-2026-73370

9.8 Critique

Publiée le 14/09/2026 à 16:17 · Modifiée le 14/09/2026 à 22:58 · Analyse NVD reportée · Source : security@apache.org

Description

Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks performed by Reconciliation service's pull and push, being incomplete, could accept calls by administrator not provided with adequate entitlements. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

Traduire en français

Produits concernés

Apache Software Foundation Apache Syncope

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.8 Critique	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-863

Références

https://lists.apache.org/thread/prv0k3mvorzhngdw405sgb87ckw105gz
http://www.openwall.com/lists/oss-security/2026/09/14/8

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories