CVE-2026-110535: Apache Software Foundation Apache Syncope

Описание

Оригинално описание

Improper Privilege Management vulnerability in Apache Syncope. AuthProfile self-updates allow non-admin users to configure impersonation for WA surrogate authentication. This issue affects Apache Syncope: from 3.0.12 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3. Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.

Засегнати продукти

• Apache Software Foundation Apache Syncope: 3.0.12 до 3.0.16; 4.0.0-M0 до 4.0.8; 4.1.0-M0 до 4.1.3

Вид слабост

• CWE-269 Неправилно управление на привилегии

История

Други уязвимости в Apache Software Foundation Apache Syncope

• CVE-2026-114364
• CVE-2026-113687
• CVE-2026-113511
• CVE-2026-109083
• 6.1CVE-2026-73191

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-110535
• https://nvd.nist.gov/vuln/detail/CVE-2026-110535
• https://lists.apache.org/thread.html/25vbq0pvj8svk8gl8pjld1j0nzrdxy26
• http://www.openwall.com/lists/oss-security/2026/11/02/8