Paper/Archive/CVE-2026-73668

CVE-2026-73668

Apache Software Foundation Apache Syncope — Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values

EPSS 0.5%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 43.7.437 × 208.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Incorrect Authorization vulnerability in Apache Syncope. An administrator with adequate entitlements in a given Realm may be able to read via REST the full Connector configuration, confidential properties included, scoped in another Realm and thus be able to effectively duplicate such Connector instance into the Realm they have administration rights for. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

Affected

ProductAffectedFixed inSource

Apache Syncope3.0.0-M0 – 3.0.16–CNA

Apache Syncope4.0.0-M0 – 4.0.7–CNA

Apache Syncope4.1.0-M0 – 4.1.2–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorylists.apache.org/thread/4lgsbbgc72mngf6mc1q5b1cj3d9nyphn refopenwall.com/lists/oss-security/2026/09/14/11