{"id":"CVE-2026-73470","state":"PUBLISHED","title":"Apache Syncope: Delegating users can grant unowned Roles","description":"Improper Privilege Management vulnerability in Apache Syncope.\n\n\n\n\n\nDelegations can be created or updated with Roles not owned by the delegating User, or not for the same Realm subtree under the delegation management was granted for.\n\n\n\nThis issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2.\n\n\nUsers are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.","publishedAt":"2026-09-14T12:58:51.370Z","updatedAt":"2026-09-14T19:28:54.807Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"apache","products":["Apache Software Foundation Apache Syncope"],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Syncope","packageName":"org.apache.syncope.core:syncope-core-provisioning-java","packageURL":"pkg:maven/org.apache.syncope.core/syncope-core-provisioning-java","defaultStatus":"unaffected","versions":[{"version":"3.0.0-M0","status":"affected","lessThanOrEqual":"3.0.16","versionType":"semver"},{"version":"4.0.0-M0","status":"affected","lessThanOrEqual":"4.0.7","versionType":"semver"},{"version":"4.1.0-M0","status":"affected","lessThanOrEqual":"4.1.2","versionType":"semver"}],"collectionURL":"https://repo.maven.apache.org/maven2"}],"references":["https://lists.apache.org/thread/13hph8sgx3wo6m103x0oc0zydf5rkl8y","http://www.openwall.com/lists/oss-security/2026/09/14/9"],"weaknesses":["CWE-269"],"ingestedAt":"2026-10-29T20:12:58.252Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/73xxx/CVE-2026-73470.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-73470","state":"PUBLISHED","datePublished":"2026-09-14T12:58:51.370Z","dateUpdated":"2026-09-14T19:28:54.807Z","assignerShortName":"apache","assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateReserved":"2026-08-12T16:53:28.488Z"},"containers":{"cna":{"title":"Apache Syncope: Delegating users can grant unowned Roles","descriptions":[{"lang":"en","value":"Improper Privilege Management vulnerability in Apache Syncope.\n\n\n\n\n\nDelegations can be created or updated with Roles not owned by the delegating User, or not for the same Realm subtree under the delegation management was granted for.\n\n\n\nThis issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2.\n\n\nUsers are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue."}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Syncope","packageName":"org.apache.syncope.core:syncope-core-provisioning-java","packageURL":"pkg:maven/org.apache.syncope.core/syncope-core-provisioning-java","defaultStatus":"unaffected","versions":[{"version":"3.0.0-M0","status":"affected","lessThanOrEqual":"3.0.16","versionType":"semver"},{"version":"4.0.0-M0","status":"affected","lessThanOrEqual":"4.0.7","versionType":"semver"},{"version":"4.1.0-M0","status":"affected","lessThanOrEqual":"4.1.2","versionType":"semver"}],"collectionURL":"https://repo.maven.apache.org/maven2"}],"references":[{"url":"https://lists.apache.org/thread/13hph8sgx3wo6m103x0oc0zydf5rkl8y","tags":["vendor-advisory"]}],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"important"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-269","description":"CWE-269 Improper Privilege Management","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"apache","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateUpdated":"2026-09-14T12:58:51.370Z"},"source":{"discovery":"UNKNOWN"},"credits":[{"lang":"en","value":"n0mi1k","type":"finder"}],"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/09/14/9"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2026-09-14T18:09:05.683Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-09-14T19:28:28.250255Z","id":"CVE-2026-73470","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-14T19:28:54.807Z"}}]}}}