CVE-2026-73370criticalCWE-863

CVE-2026-73370: fallo crítico en Apache Syncope

Apache Syncope: Cross-Realm boundaries reconciliation bypass

Publicada el

Seguir esta CVE+ Monitorear Apache Syncope

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.8epss 0.5%
Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks performed by Reconciliation service's pull and push, being incomplete, could accept calls by administrator not provided with adequate entitlements. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Apache Software Foundation · Apache Syncope
CVEs relacionadas — Apache Syncope

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-57738HIGHApache Syncope: Remote Code Execution by delegated administratorsEPSS 24.2%CVE-2018-1322—CVE-2018-1322EPSS 19.9%CVE-2018-1321—CVE-2018-1321EPSS 17.5%CVE-2018-17186—CVE-2018-17186EPSS 2.5%CVE-2026-23795MEDIUMApache Syncope: Console XXE on Keymaster parametersEPSS 2.0%CVE-2018-17184—CVE-2018-17184EPSS 1.2%