Description

Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks performed by Reconciliation service's pull and push, being incomplete, could accept calls by administrator not provided with adequate entitlements. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-14T14:17:09.077Z",
  "pubdate": "2026-09-14T14:17:09.077Z",
  "executiveSummary": "Apache Syncope contains an incorrect authorization vulnerability within its delegated administration functionality. The issue resides in the Reconciliation service, specifically concerning pull and push operations, where security checks fail to adequately validate user entitlements.\nThis vulnerability allows an authenticated administrator with insufficient privileges to perform unauthorized actions by bypassing intended access control constraints. The flaw affects Apache Syncope versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.\nThe risk is categorized as high, as it undermines the integrity of delegated administrative controls, potentially allowing privilege escalation or unauthorized data synchronization. Successful exploitation requires an attacker to possess administrative credentials, albeit lacking the specific entitlements usually required for the targeted pull or push operations.\nThe primary impact involves the compromise of access control enforcement, which could lead to unauthorized modification or exposure of identity data handled by the Reconciliation service. Users are strongly advised to upgrade to the remediated versions 4.0.8 or 4.1.3 to restore proper authorization enforcement.",
  "technicalDetails": "The vulnerability is rooted in an incomplete implementation of delegated administration security checks within the Reconciliation service of Apache Syncope. In the context of Identity and Access Management (IAM) systems, delegated administration relies on strict entitlement verification to ensure that administrators can only manage subsets of resources or perform operations permitted by their specific roles and scope.\nDuring pull and push operations—which involve synchronizing identity data between Apache Syncope and external connectors—the Reconciliation service fails to perform a comprehensive validation of the requestor's authorization tokens against the required entitlements. While the service identifies the requestor as an administrator, it neglects to verify if that specific administrative identity possesses the granular permissions required to execute the requested synchronization task.\nThe exploitation flow begins when an attacker, who has been granted administrative access to the platform but lacks the necessary fine-grained entitlements, initiates a pull or push request through the Reconciliation interface. Because the backend service performs an incomplete check, it treats the session as authorized despite the missing requirements.\nTechnically, the vulnerability stems from a failure to correctly invoke the authorization interceptor or logic governing the Reconciliation service's internal endpoints. When the service processes these calls, it skips the necessary authorization check, allowing the command to proceed to the underlying data processing engine. Consequently, the attacker can manipulate identity data or trigger synchronization flows that are outside the scope of their assigned privileges.\nThis issue exposes the system to unauthorized data manipulation and potential configuration drift. Because the vulnerability exists within the logic of the Reconciliation service, it is accessible to any user who has achieved an administrative session context, regardless of their actual permission level. The lack of validation ensures that the system essentially trusts the caller's administrative status without verifying the specific scope-based entitlement constraints required for secure delegated administration.\nThe affected versions include the 3.0.x branch up to 3.0.16, the 4.0.x branch up to 4.0.7, and the 4.1.x branch up to 4.1.2. The lack of proper authorization control means that any action performed via the vulnerable service is treated as fully authorized by the system, effectively bypassing the security model of the delegated administration framework."
}