Apache Syncope improper privilege management in delegations
Improper privilege management in Apache Syncope allows delegation assignments to reference Roles the delegating user does not own, or Realms outside the expected subtree, breaking the Realm-based access control model.
- Vendor
- Apache
- Product
- Syncope
- CVSS
- 9.8
- EPSS (exploit probability)
- 0.5%
- Status
- patched
- Published
Is CVE-2026-73470 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-73470 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-11 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.5% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-11. Full cross-catalog view: /kev-comparison
CVE-2026-73470 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
Apache Syncope uses a Realm-based model to scope administrative access in multi-tenant deployments. Delegations allow an administrator to grant a subset of their permissions to another user within their Realm subtree.
CVE-2026-73470 allows a delegating user to create or update delegations that include Roles they do not own, or that span Realms outside their authorized subtree. This bypasses the scoping model and can be used to escalate privileges across Realm boundaries.
After patching, audit existing delegation assignments for any Roles or Realm assignments outside expected scope. See the advisory and the Apache Syncope patch article.
Other Apache CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2016-3081 Apache Struts Command Injection Vulnerability | [ HIGH ] | 8.1 | 96.9% | |
| CVE-2026-87802 Apache Syncope SRA allows JWT forgery without JWKS URIwrite-up | [ CRITICAL ] | 9.1 | 0.3% | — |
| CVE-2026-87785 Apache Syncope JWT authentication bypass via JWKS spoofingwrite-up | [ CRITICAL ] | 9.1 | 0.5% | — |
| CVE-2026-86460 Apache Syncope Cypher injection via Neo4j FIQL searchwrite-up | [ CRITICAL ] | 9.8 | 0.6% | — |
| CVE-2026-82232 Apache Syncope admin-level SQL injectionwrite-up | [ CRITICAL ] | 9.8 | 0.6% | — |
| CVE-2026-73668 Apache Syncope admin REST API exposes connector credentialswrite-up | [ CRITICAL ] | 9.8 | 0.5% | — |
| CVE-2026-73579 Apache Syncope search injection via FIQL to SQL/Neo4j/Elasticsearchwrite-up | [ CRITICAL ] | 9.8 | 0.5% | — |
| CVE-2026-34486 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability | [ HIGH ] | 7.5 | 98.5% |
