CVE-2026-73370

CriticalCVSS 9.8/10Last modified Sep 14, 2026

Description

Incorrect Authorization vulnerability in Apache Syncope.

Delegated administration security checks performed by Reconciliation service's pull and push, being incomplete, could accept calls by administrator not provided with adequate entitlements.

This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2.

Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published
Sep 14, 2026
Last modified
Sep 14, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-733714.3Joomla! Core - [20260808] - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows CVE-2026-733724.3Joomla! Core - [20260809] - Improper ACL checks when injection schema.org contact data in Joomla 5.1.0-5.4.7 and 6.0.0-6.1.2 - An improper aCVE-2026-733739.8Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files didCVE-2026-733746.1A stored cross-site scripting (XSS) vulnerability existed in Vulnerability-Lookup in the render_tag_badges Jinja filter used to display refeCVE-2026-733757.1Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions.CVE-2026-733769.8Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions.CVE-2026-733777.5Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions.CVE-2026-733787.1Unauthenticated Cross Site Scripting (XSS) in Contact Form by Supsystic < 1.10.0 versions.CVE-2026-733796.5Unauthenticated Bypass Vulnerability in Contact Form by Supsystic < 1.10.0 versions.CVE-2026-73387.5Use after free in Cast in Google Chrome prior to 147.0.7727.138 allowed an attacker on the local network segment to potentially exploit heapCVE-2026-733809.8Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.CVE-2026-733819.1Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions.