Description

Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks are based on Realm hierarchy and enforced via prefix matches. Due to incorrect implementation, two sibling Realms whose names begin with the same string cannot be correctly distinguished, resulting in incorrect authorization. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-14T14:17:08.817Z",
  "pubdate": "2026-09-14T14:17:08.817Z",
  "executiveSummary": "Apache Syncope contains an incorrect authorization vulnerability stemming from flawed Realm hierarchy validation logic. The flaw allows for unauthorized access across administrative domains when Realm names share a common prefix. This vulnerability affects Apache Syncope versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.\nThe vulnerability type is an Improper Authorization flaw, which occurs because the system fails to strictly distinguish between sibling Realms during delegated administration checks. The impact is a breakdown in the security boundaries defining administrative scope, potentially allowing an attacker with legitimate administrative privileges in one Realm to perform unauthorized actions in a sibling Realm that shares a similar naming convention.\nThis vulnerability poses a significant risk to the integrity of identity and access management operations, as administrative scoping controls are essentially bypassed. Successful exploitation requires an attacker to possess or compromise an account with administrative capabilities, though they do not necessarily require superuser status, provided they can target a sibling Realm with a matching name prefix.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the delegated administration security checks within Apache Syncope. These checks rely on the hierarchical structure of Realms to define the scope of administrative authority. To determine if an administrator is authorized to perform operations within a specific Realm, the system evaluates the target Realm path against the administrator's authorized Realm path using string-based prefix matching.\nThe vulnerability occurs because the validation logic uses a non-exclusive prefix match. If two sibling Realms have names where one is a prefix of the other, the authorization module erroneously evaluates them as identical or sub-hierarchical nodes. For example, if an administrator is granted rights to a Realm named '/RealmA', and a sibling Realm exists named '/RealmAB', the current implementation incorrectly matches the prefix 'RealmA' against 'RealmAB'. Consequently, the system grants the administrator of '/RealmA' implicit authorization to perform operations within '/RealmAB', despite these Realms being logically separate entities within the hierarchy.\nThe attack flow proceeds as follows: 1) An attacker identifies or creates two sibling Realms with a shared name prefix. 2) The attacker obtains or assumes administrative credentials for the Realm that acts as the prefix. 3) The attacker initiates an administrative request targeting an entity or configuration object within the sibling Realm. 4) The authorization engine performs the flawed prefix check, identifies a match, and erroneously permits the requested action. 5) The security boundary is bypassed, allowing the attacker to read, modify, or delete resources in the sibling Realm for which they should have had no administrative authority.\nThis vulnerability is restricted to the internal authorization logic of the Apache Syncope core, specifically within the delegated administration services. It requires the attacker to be authenticated as an administrative user, implying that the attack vector is internal to the application's administrative interface. The impact of successful exploitation includes potential privilege escalation and unauthorized access to identity management data, potentially leading to a full compromise of objects residing in the targeted sibling Realm. Because the issue is inherent to the string-matching logic of the Realm hierarchy management, the only resolution is the application of the vendor-provided patch which replaces or refines the matching algorithm to enforce exact path validation rather than simple prefix matching."
}