CVE-2026-113511

CriticalCVSS 9.1/10Last modified Nov 6, 2026

Description

Authorization bypass through User-Controlled key vulnerability in Apache Syncope.

A delegated administrator can relocate a Realm subtree across administrative realm boundaries without permission for the destination This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3.

Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-639

Affected software

VendorProductVersions
Apache Software FoundationApache Syncope>= 3.0.0-M0, <= 3.0.16; >= 4.0.0-M0, <= 4.0.8; >= 4.1.0-M0, <= 4.1.3

References

Timeline

Published
Nov 2, 2026
Last modified
Nov 6, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1135127.8After Effects is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of theCVE-2026-1135145.5After Effects is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leveraCVE-2026-1135167.8After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the currenCVE-2026-1135177.8After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the currenCVE-2026-1135195.5After Effects is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leveraCVE-2026-113527.5An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurCVE-2026-1135215.5After Effects is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker couCVE-2026-1135237.8After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the currenCVE-2026-1135257.8After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the currenCVE-2026-1135268.6After Effects is affected by a Violation of Secure Design Principles vulnerability that could result in arbitrary code execution in the contCVE-2026-1135287.8After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the currenCVE-2026-1135307.8After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the curren
CVE-2026-113511: Critical severity, CVSS 9.1 | Vulnix