Nic Jones

**Name of the Vulnerable Software and Affected Versions** Apache Syncope versions 3.0.0-M0 through 3.0.16 Apache Syncope versions 4.0.0-M0 through 4.0.6 Apache Syncope versions 4.1.0-M0 through 4.1.1 **Description** Improper Privilege Management allows a user to escalate privileges to an administrator level. This occurs when the all-Java user workflow adapter is configured, or the Flowable user workflow adapter is used with a BPMN definition that does not require administrator approval for user self-registration or self-update requests. In these configurations, a REST API call can be used to grant the user one or more defined Roles, providing them with associated Entitlements. **Recommendations** Upgrade versions 3.0.0-M0 through 3.0.16 to version 4.0.7 Upgrade versions 4.0.0-M0 through 4.0.6 to version 4.0.7 Upgrade versions 4.1.0-M0 through 4.1.1 to version 4.1.2