CVE-2026-73178

HighCVSS 7.5/10Last modified Sep 14, 2026

Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Syncope.

An administrator with adequate entitlements can get access via REST to the list of existing Access Tokens, including their signed JWT body. These values can be then used to perform further REST requests, impersonating users with higher administration entitlements.

This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2.

Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Sep 14, 2026
Last modified: Sep 14, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-731798.1Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a re CVE-2026-73185.9A vulnerability was detected in elie mcp-project 0.1.0. The affected element is the function search_papers of the file research_server.py. T CVE-2026-731806.8Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed af CVE-2026-731817.5Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce < 7.6 versions.CVE-2026-731827.1Unauthenticated Cross Site Scripting (XSS) in BBQ Pro <= 3.9 versions.CVE-2026-731839.3Unauthenticated SQL Injection in Maps Marker Pro <= 4.32 versions.CVE-2026-731847.1Unauthenticated Cross Site Scripting (XSS) in Global Gallery <= 11.1.2 versions.CVE-2026-731859.3Unauthenticated SQL Injection in NGG Smart Image Search < 4.0.0 versions.CVE-2026-731879.3Unauthenticated SQL Injection in Sticky Chat Widget <= 1.4.2 versions.CVE-2026-73197.3A flaw has been found in elinsky execution-system-mcp 0.1.0. The impacted element is the function _get_context_file_path of the file src/exe CVE-2026-731907.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in W3 Eden WPDM – Premium Packages wpdm-p CVE-2026-731916.1URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Syncope. When the Syncope SRA is configured for CAS authent