CVE-2026-73370

CriticalCVSS 9.8/10Last modified Sep 14, 2026

Description

Incorrect Authorization vulnerability in Apache Syncope.

Delegated administration security checks performed by Reconciliation service's pull and push, being incomplete, could accept calls by administrator not provided with adequate entitlements.

This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2.

Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Syncope	>= 3.0.0-M0, <= 3.0.16; >= 4.0.0-M0, <= 4.0.7; >= 4.1.0-M0, <= 4.1.2

References

Timeline

Published: Sep 14, 2026
Last modified: Sep 14, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-733714.3Joomla! Core - [20260808] - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows CVE-2026-733724.3Joomla! Core - [20260809] - Improper ACL checks when injection schema.org contact data in Joomla 5.1.0-5.4.7 and 6.0.0-6.1.2 - An improper a CVE-2026-733739.8Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did CVE-2026-733746.1A stored cross-site scripting (XSS) vulnerability existed in Vulnerability-Lookup in the render_tag_badges Jinja filter used to display refe CVE-2026-733757.1Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions.CVE-2026-733769.8Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions.CVE-2026-733777.5Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions.CVE-2026-733787.1Unauthenticated Cross Site Scripting (XSS) in Contact Form by Supsystic < 1.10.0 versions.CVE-2026-733796.5Unauthenticated Bypass Vulnerability in Contact Form by Supsystic < 1.10.0 versions.CVE-2026-73387.5Use after free in Cast in Google Chrome prior to 147.0.7727.138 allowed an attacker on the local network segment to potentially exploit heap CVE-2026-733809.8Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.CVE-2026-733819.1Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions.