CVE-2026-73470

An incorrect authorization vulnerability in Apache Syncope affects the Reconciliation service (pull and push). Due to incomplete delegated administration security checks, calls by administrators lacking proper entitlements may be accepted, enabling unauthorized actions.

An incorrect privilege assignment vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed (at least protocol and key), an attacker can obtain admin privileges after completing successful authentication and obtaining a valid low-privileges JWT.

Apache Syncope has an incorrect authorization vulnerability. An administrator with ClientApp's update entitlement is unable to perform the related operation, while ClientApp's create entitlement is checked both for create and update operations on ClientApp.

Apache Syncope has an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized entityKey and opEvent parameters.

Apache Syncope has a missing authorization vulnerability. An administrator with task execution entitlements might be able to mass (de)provision group members, regardless of their group-related administration capabilities.

Apache Syncope has an incorrect authorization vulnerability. An administrator with adequate entitlements in a given Realm may be able to read via REST the full Connector configuration, confidential properties included, scoped in another Realm and thus be able to effectively duplicate such Connector instance into the Realm they have administration rights for.

Apache Syncope has an incorrect authorization vulnerability. Search requests are transformed into SQL, Neo4J or Elasticsearch/Opensearch queries, and the Realms filter that should restrict results to the requester's permissions may be rendered as empty for non-recursive search requests, voiding privilege restrictions.

Improper verification of cryptographic signature vulnerability in Apache Syncope. When SRA is configured for OAuth 2.0 without a JWKS set URI assigned, an attacker can forge arbitrary JWTs to impersonate any user identity and permissions, gaining full access to services proxied by SRA.

Authentication bypass by spoofing vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed (at least protocol and key), an attacker can spoof another user's privileges after completing a successful authentication and obtaining a valid JWT.

Cypher injection vulnerability in the Neo4j persistence layer when processing some FIQL search conditions. This may allow manipulation of graph database queries.