Apache Syncope improper privilege management in delegations
Improper privilege management in Apache Syncope allows delegation assignments to reference Roles the delegating user does not own, or Realms outside the expected subtree, breaking the Realm-based access control model.
- Vendor
- Apache
- Product
- Syncope
- CVSS
- 9.8
- EPSS (exploit probability)
- 0.5%
- Status
- patched
- Published
Apache Syncope uses a Realm-based model to scope administrative access in multi-tenant deployments. Delegations allow an administrator to grant a subset of their permissions to another user within their Realm subtree.
CVE-2026-73470 allows a delegating user to create or update delegations that include Roles they do not own, or that span Realms outside their authorized subtree. This bypasses the scoping model and can be used to escalate privileges across Realm boundaries.
After patching, audit existing delegation assignments for any Roles or Realm assignments outside expected scope. See the advisory and the Apache Syncope patch article.
