CVE-2026-73236

Name of the Vulnerable Software and Affected Versions Apache Syncope versions 3.0.0-M0 through 3.0.16 Apache Syncope versions 4.0.0-M0 through 4.0.7 Apache Syncope versions 4.1.0-M0 through 4.1.2

Description An incorrect authorization issue exists in the delegated administration security checks, which rely on Realm hierarchy and prefix matches. Because of an implementation error, the system cannot distinguish between two sibling Realms if their names start with the same string, leading to unauthorized access.

Recommendations Upgrade versions 3.0.0-M0 through 3.0.16 to version 4.0.8 or 4.1.3. Upgrade versions 4.0.0-M0 through 4.0.7 to version 4.0.8 or 4.1.3. Upgrade versions 4.1.0-M0 through 4.1.2 to version 4.1.3.