CVE-2026-73370: Apache Software Foundation Apache Syncope, заобикаляне

Описание

Оригинално описание

Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks performed by Reconciliation service's pull and push, being incomplete, could accept calls by administrator not provided with adequate entitlements. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

Засегнати продукти

• Apache Software Foundation Apache Syncope: 3.0.0-M0 до 3.0.16; 4.0.0-M0 до 4.0.7; 4.1.0-M0 до 4.1.2

Вид слабост

• CWE-863 Incorrect Authorization

История

Други уязвимости в Apache Software Foundation Apache Syncope

• CVE-2026-114364
• CVE-2026-113687
• CVE-2026-113511
• CVE-2026-110535
• CVE-2026-109083

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-73370
• https://nvd.nist.gov/vuln/detail/CVE-2026-73370
• https://lists.apache.org/thread/prv0k3mvorzhngdw405sgb87ckw105gz
• http://www.openwall.com/lists/oss-security/2026/09/14/8