Paper/Archive/CVE-2026-113511

CVE-2026-113511

Apache Software Foundation Apache Syncope — Apache Syncope: Delegated administration boundaries can be bypassed for Realm update

EPSS 0.4%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (ADP)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 37.8.378 × 207.6 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Authorization bypass through User-Controlled key vulnerability in Apache Syncope. A delegated administrator can relocate a Realm subtree across administrative realm boundaries without permission for the destination This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3. Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.

Affected

ProductAffectedFixed inSource

Apache Syncope3.0.0-M0 – 3.0.16–CNA

Apache Syncope4.0.0-M0 – 4.0.8–CNA

Apache Syncope4.1.0-M0 – 4.1.3–CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorylists.apache.org/thread.html/gn7y6k37xgody4wt4o981cywcovgw106 refopenwall.com/lists/oss-security/2026/11/02/9