CVE-2026-113511: Apache Software Foundation Apache Syncope

Описание

Оригинално описание

Authorization bypass through User-Controlled key vulnerability in Apache Syncope. A delegated administrator can relocate a Realm subtree across administrative realm boundaries without permission for the destination This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3. Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.

Засегнати продукти

• Apache Software Foundation Apache Syncope: 3.0.0-M0 до 3.0.16; 4.0.0-M0 до 4.0.8; 4.1.0-M0 до 4.1.3

Вид слабост

• CWE-639 Authorization Bypass Through User-Controlled Key

История

Други уязвимости в Apache Software Foundation Apache Syncope

• CVE-2026-114364
• CVE-2026-113687
• CVE-2026-110535
• CVE-2026-109083
• 6.1CVE-2026-73191

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-113511
• https://nvd.nist.gov/vuln/detail/CVE-2026-113511
• https://lists.apache.org/thread.html/gn7y6k37xgody4wt4o981cywcovgw106
• http://www.openwall.com/lists/oss-security/2026/11/02/9