Live › vulnerability › CVE-2026-110535
Apache Syncope lets regular users change their own authentication profile to allow impersonation through WA surrogate authentication. An attacker with an ordinary account could then log in as other users.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 14:23 UTC. All times on this page are UTC.
Teams running Apache Syncope identity management in the affected version ranges that use WA surrogate authentication are exposed, since regular users can edit their own AuthProfile to enable impersonation. Deployments on other versions, or without surrogate authentication in use, are likely not affected; the sources do not say more.
No product ranges from the sources yet.
3.0.12 through 3.0.16, 4.0.0-M0 through 4.0.8, and 4.1.0-M0 through 4.1.3.4.0.x line: upgrade to 4.0.94.1.x line: upgrade to 4.1.43.0.x: the sources do not name a fixed 3.0 release.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Privilege Management vulnerability in Apache Syncope.
AuthProfile self-updates allow non-admin users to configure impersonation for WA surrogate authentication. This issue affects Apache Syncope: from 3.0.12 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3.
Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-110535")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.