CVE-2026-53421

An incorrect authorization vulnerability in Apache Syncope affects the Reconciliation service (pull and push). Due to incomplete delegated administration security checks, calls by administrators lacking proper entitlements may be accepted, enabling unauthorized actions.

An incorrect privilege assignment vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed (at least protocol and key), an attacker can obtain admin privileges after completing successful authentication and obtaining a valid low-privileges JWT.

Improper verification of cryptographic signature vulnerability in Apache Syncope. When SRA is configured for OAuth 2.0 without a JWKS set URI assigned, an attacker can forge arbitrary JWTs to impersonate any user identity and permissions, gaining full access to services proxied by SRA.

Authentication bypass by spoofing vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed (at least protocol and key), an attacker can spoof another user's privileges after completing a successful authentication and obtaining a valid JWT.

Cypher injection vulnerability in the Neo4j persistence layer when processing some FIQL search conditions. This may allow manipulation of graph database queries.

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort clauses for Task search.

An Improper Isolation or Compartmentalization vulnerability in Apache Syncope allows an administrator with adequate entitlements to create a malicious Groovy class containing untrusted code, bypassing the Groovy security sandbox.

An improper privilege management vulnerability exists in Apache Syncope. A user can exploit a REST API call to grant themselves administrative roles, gaining full control over the system. Affected versions: 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1.

An SQL Injection vulnerability in Apache Syncope allows an administrator with adequate entitlements to execute arbitrary SQL via stacked queries using unsanitized sort parameters. Affected versions: 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1.

A vulnerability in Apache Syncope allows improper isolation of Groovy scripts in BPMN processes. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and start them, causing the Groovy script to execute directly on the server without a sandbox.