CVE-2026-77181

CriticalCVSS 9.8/10Last modified Sep 14, 2026

Description

Incorrect Authorization vulnerability in Apache Syncope.

An administrator with ClientApp's update entitlement is unable to perform the related operation, while ClientApp's create entitlement is checked both for create and update operations on ClientApp.

This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2.

Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Syncope	>= 3.0.0-M0, <= 3.0.16; >= 4.0.0-M0, <= 4.0.7; >= 4.1.0-M0, <= 4.1.2

References

Timeline

Published: Sep 14, 2026
Last modified: Sep 14, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-771838.8The FooSales – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all ve CVE-2026-771845.2In MongoDB Connector for BI, the description text of a collection's JSON schema validator is incorporated into the comment text of the DDL r CVE-2026-771859.1Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 for a certain (presumed rare) way t CVE-2026-771866.4The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fallback' Shortcode Attrib CVE-2026-771876.4The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'before' and 'after' Shortc CVE-2026-771886.4The Waitlist Woocommerce ( Back in stock notifier ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'type' Shortcode A CVE-2026-771896.5The Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) plugin for WordPress is vulne CVE-2026-77199.8A security flaw has been discovered in Totolink WA300 5.2cu.7112_B20190227. The affected element is the function loginauth of the file /cgi-CVE-2026-771906.5On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device CVE-2026-771912.6An authenticated supplicant on an adjacent network may bypass intended network authorization policy and send unrestricted traffic during a b CVE-2026-771937.5The eesy_ID2WP – Publish InDesign HTML5 plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.3 via CVE-2026-771945.3The Simple Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in versions up t