Incorrect authorization in Apache Syncope - CVE-2026-73236
Published: September 15, 2026
Vulnerability identifier: #VU149981
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-73236
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to bypass cross-realm authorization restrictions.
The vulnerability exists due to incorrect authorization in delegated administration realm hierarchy security checks when handling delegated administration requests for sibling realms whose names begin with the same string. A remote user can exploit prefix matching to bypass cross-realm authorization restrictions.
Affected software
Apache Syncope
How to mitigate CVE-2026-73236
Install security update from vendor's website.
Apache Syncope - addressed in versions 4.0.8, 4.1.3