CVE-2026-73579 Details
Description
Incorrect Authorization vulnerability in Apache Syncope. Any search requests are transformed into SQL, Neo4J or Elasticsearch / Opensearch queries, depending on the actual deployment configuration. An important component of such transformation is the Realms filter, which ensures that the search results are matching the requester's permissions. For non-recursive search requests it is possible that such Realms filter is rendered as empty, thus voiding any restriction on requester privileges. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
A vulnerability allowing incorrect authorization has been identified in Apache Syncope versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. This vulnerability arises because certain search requests can be transformed into SQL, Neo4J, or Elasticsearch/Opensearch queries, depending on the deployment configuration. A key aspect of this transformation is the Realms filter, which is meant to align search results with the requester's permissions. However, for non-recursive search requests, the Realms filter may be omitted, effectively removing any restrictions on the requester's privileges.
Users are advised to upgrade to Apache Syncope versions 4.0.8 or 4.1.3, both of which address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 14, 2026CISA-ADP
Assessed Sep 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/09/14/10 | CVE | AdvisoryMailing ListRemedy |
| https://lists.apache.org/thread/ykwnkrt2b43d0wm1phh94pqqyjb6qyhx | [email protected] | AdvisoryMailing ListRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Apache Syncope | >= 3.0.0-M0, <= 3.0.16 (semver) >= 4.0.0-M0, <= 4.0.7 (semver) >= 4.1.0-M0, <= 4.1.2 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | CISA-ADP |
| Sep 14, 2026 | CVE Modified | CVE |
| Sep 14, 2026 | New CVE Received | [email protected] |