CVE-2026-86460

An incorrect authorization vulnerability in Apache Syncope stems from flawed implementation of Realm hierarchy-based checks. Permission enforcement uses prefix matching, making it impossible to correctly distinguish between two sibling Realms whose names begin with the same string, leading to unauthorized access.

Improper Encoding or Escaping of Output vulnerability in Apache Syncope. Authenticated users can store a spreadsheet formula payload in one of their own plain attributes. When such users are included in a CSV export and the generated CSV file is opened by a spreadsheet application, the formula may be executed. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

An Open Redirect vulnerability in Apache Syncope affects the SRA (Syncope REST API) when configured for CAS authentication. The target Apereo CAS instance's URL is calculated unconditionally from client-supplied forwarded HTTP headers, allowing an attacker to control the redirect destination.

A vulnerability in Apache Syncope that involves insertion of sensitive information into sent data. Any authenticated user can query the list of available OIDC providers configured for SSO with Console and Enduser. The returned payload contains all configuration settings, including client secrets, regardless of the caller's entitlements.

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy Command class containing untrusted code in their CommandArgs static implementation, bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

A vulnerability in Apache Syncope allows an administrator with adequate entitlements to access via REST the list of existing Access Tokens, including their signed JWT body. These tokens can then be used for further REST requests, impersonating users with higher administration privileges.

Insertion of sensitive information into log file vulnerability in Apache Syncope. When an AES key of non-standard length (not 16/24/32 bytes) is configured, Syncope will pad the provided value with random characters, and the resulting key value is logged.

An incorrect authorization vulnerability in Apache Syncope affects the Reconciliation service (pull and push). Due to incomplete delegated administration security checks, calls by administrators lacking proper entitlements may be accepted, enabling unauthorized actions.

An incorrect privilege assignment vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed (at least protocol and key), an attacker can obtain admin privileges after completing successful authentication and obtaining a valid low-privileges JWT.

Improper verification of cryptographic signature vulnerability in Apache Syncope. When SRA is configured for OAuth 2.0 without a JWKS set URI assigned, an attacker can forge arbitrary JWTs to impersonate any user identity and permissions, gaining full access to services proxied by SRA.