Information disclosure in Apache Syncope - CVE-2026-73178
Published: September 15, 2026
Vulnerability identifier: #VU149983
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-73178
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to impersonate users with higher administration entitlements.
The vulnerability exists due to exposure of sensitive information to an unauthorized actor in the REST access token listing functionality when accessing the list of existing access tokens via REST. A remote privileged user can retrieve signed JWT bodies from existing access tokens to impersonate users with higher administration entitlements.
Affected software
Apache Syncope
How to mitigate CVE-2026-73178
Install security update from vendor's website.
Apache Syncope - addressed in versions 4.0.8, 4.1.3