Description

Incorrect Authorization vulnerability in Apache Syncope. An administrator with ClientApp's update entitlement is unable to perform the related operation, while ClientApp's create entitlement is checked both for create and update operations on ClientApp. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-14T13:18:46.623Z",
  "pubdate": "2026-09-14T13:18:46.623Z",
  "executiveSummary": "This vulnerability involves an Incorrect Authorization flaw within Apache Syncope, impacting the management of ClientApp entities. The security defect arises from an improper enforcement of entitlement checks during update operations. Specifically, the system erroneously validates the 'ClientApp_CREATE' entitlement instead of the required 'ClientApp_UPDATE' entitlement when an administrator attempts to modify an existing application.\nThe flaw affects multiple release branches, including 3.0.x, 4.0.x, and 4.1.x. This authorization bypass allows authenticated administrators with specific, limited privileges to perform unauthorized modifications to ClientApp configurations if they possess the create entitlement, or conversely, prevents authorized administrators lacking the create entitlement from performing valid updates.\nThe risk implication is a breach of the principle of least privilege, potentially leading to unauthorized system configuration changes or administrative denial-of-service regarding application management. Exploitation requires the attacker to hold administrative credentials within the Apache Syncope environment. Users are strongly advised to update to the remediated versions to restore correct access control logic.",
  "technicalDetails": "The vulnerability resides within the authorization management logic of Apache Syncope's administrative backend. In the context of ClientApp management, the application employs a Role-Based Access Control (RBAC) mechanism governed by fine-grained entitlements. The root cause is a logic error in the authorization interceptor or service layer responsible for validating requests to the ClientApp management endpoints.\nDuring an update operation for a ClientApp, the security middleware incorrectly references the 'ClientApp_CREATE' entitlement check rather than the 'ClientApp_UPDATE' entitlement. This misconfiguration introduces two distinct security impacts: 1) Authorization Bypass: An administrator possessing only the create entitlement is inadvertently granted authorization to execute update operations, exceeding their assigned scope of authority. 2) Denial of Service (Administrative): An administrator possessing the update entitlement—but explicitly denied the create entitlement—is blocked from performing legitimate configuration updates, effectively rendering them unable to perform their assigned duties.\nThe attack flow initiates when an authenticated administrator submits a PUT or PATCH request to the ClientApp service endpoint. The request is intercepted by the security framework, which performs a lookup against the user's assigned entitlement set. Due to the hardcoded or incorrectly mapped entitlement check, the system verifies the presence of 'ClientApp_CREATE' in the user's authorization claims. If the user possesses this entitlement, the update operation proceeds, regardless of whether they have been granted specific update privileges. Conversely, if the user lacks the create entitlement, the operation is rejected, causing a 403 Forbidden error.\nAffected versions include Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. The vulnerability is triggered via the standard administrative API and requires a pre-authenticated session with insufficient or misaligned administrative privileges. Post-exploitation, an attacker could potentially modify existing ClientApp parameters, such as redirect URIs or security keys, if they have acquired the create entitlement through improper role assignment, leading to downstream impacts like OpenID Connect/OAuth2 flow manipulation."
}