Apache Syncope: 22 Critical Vulnerabilities Disclosed in Single Batch, Exploiting Auth and Input Validation
Apache Syncope patched 22 vulnerabilities, including critical flaws allowing SQL injection, code execution, and authentication bypass, impacting identity and access management.
Key findings
- 22 vulnerabilities disclosed simultaneously for Apache Syncope, including critical authorization and injection flaws.
- Critical vulnerabilities allow for SQL injection, code execution, and authentication bypass.
- Affected versions range from 3.0.0-M0 to 4.1.2; patched in 4.0.8 and 4.1.3.
- Flaws impact identity management, access governance, and user provisioning functions.
- Sensitive information exposure risks include client secrets and access tokens.
On September 14, 2026, a significant batch of 22 vulnerabilities was disclosed for Apache Syncope, an open-source identity management and access governance platform. These vulnerabilities, disclosed within a three-hour window, span critical and high severity ratings, with many stemming from authorization and input validation flaws. The disclosures highlight potential risks for organizations relying on Syncope for managing user identities, roles, and access controls across enterprise applications.
Several vulnerabilities center on authorization bypass and incorrect privilege assignment. CVE-2026-73370, a critical Incorrect Authorization vulnerability, allows administrators without adequate entitlements to perform reconciliation actions. Similarly, CVE-2026-73236 exploits an incorrect implementation of realm hierarchy checks, enabling unauthorized access between sibling realms. CVE-2026-77181 and CVE-2026-73668 also fall into this category, allowing administrators to access sensitive connector configurations or existing access tokens, potentially leading to impersonation. CVE-2026-75030, a missing authorization flaw, could permit unauthorized mass (de)provisioning of group members.
Input validation and data handling issues also form a significant part of this disclosure batch. CVE-2026-73195 describes an Improper Encoding or Escaping of Output vulnerability where authenticated users can inject spreadsheet formula payloads, leading to formula execution when CSV exports are opened. CVE-2026-77051 and CVE-2026-82232 detail SQL injection vulnerabilities, allowing arbitrary SQL execution via unsanitized parameters and sort clauses, respectively. A related Cypher injection vulnerability, CVE-2026-86460, affects the Neo4j persistence layer when processing FIQL search conditions. Furthermore, CVE-2026-77147, a Code Injection vulnerability, allows administrators to bypass the Groovy security sandbox by crafting malicious Groovy Command classes.
Security concerns also extend to sensitive information exposure and authentication bypass. CVE-2026-78336 allows any authenticated user to query for OIDC providers and retrieve sensitive configuration details, including client secrets. CVE-2026-78318 and CVE-2026-77883 expose sensitive information through data queries and notification messages, respectively. Critical vulnerabilities CVE-2026-78330 and CVE-2026-87785 involve improper privilege assignment and authentication bypass through disclosed JWKS settings for internal JWT authentication, enabling attackers to gain admin privileges or spoof user identities. CVE-2026-87802 presents an authentication bypass by spoofing via forged JWTs when SRA is configured for OAuth 2.0 without a JWKS set URI.
The vulnerabilities affect Apache Syncope versions from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Patches are available in versions 4.0.8 and 4.1.3. Organizations using affected versions are strongly recommended to upgrade to the patched releases to mitigate these risks.
This extensive batch of vulnerabilities underscores the importance of regular security audits and timely patching for identity management systems like Apache Syncope, which often handle highly sensitive user and access data. The concentration of critical authorization and injection flaws highlights the need for robust security configurations and vigilant monitoring of administrative actions within the platform.
The following CVEs were part of this disclosure: CVE-2026-73370, CVE-2026-73236, CVE-2026-73195, CVE-2026-73191, CVE-2026-78336, CVE-2026-78330, CVE-2026-78318, CVE-2026-77883, CVE-2026-77181, CVE-2026-77147, CVE-2026-77051, CVE-2026-75030, CVE-2026-75015, CVE-2026-73668, CVE-2026-73579, CVE-2026-73470, CVE-2026-73178, CVE-2026-87802, CVE-2026-87785, CVE-2026-87779, CVE-2026-86460, CVE-2026-82232. As noted by Cyber Security News, CVE-2026-82232, CVE-2026-77147, and CVE-2026-73178 are among the critical vulnerabilities that could allow administrators to execute malicious SQL commands, bypass Groovy sandbox protections, and impersonate users. Cyber Security News