Apache Syncope admin REST API exposes connector credentials
Incorrect authorization in Apache Syncope allows any administrator in a given Realm to read the full Connector configuration via REST, including plaintext credentials for LDAP directories, Active Directory, and external databases.
- Vendor
- Apache
- Product
- Syncope
- CVSS
- 9.8
- EPSS (exploit probability)
- 0.5%
- Status
- patched
- Published
Apache Syncope Connectors define how Syncope communicates with external identity systems: LDAP servers, Active Directory, relational databases, and other backends. These Connector objects store credentials for those systems.
CVE-2026-73668 allows any Syncope administrator with entitlements in a given Realm to retrieve the full Connector configuration through the REST API, including the stored credentials in plaintext. There is no requirement for the administrator to own or manage the Connector directly.
After patching, rotate credentials stored in all Connector objects. LDAP bind passwords and database service accounts are the highest-priority items. See the full advisory and the Apache Syncope patch article.
