{"id":"CVE-2026-110535","kind":"vulnerability","aliases":["CVE-2026-110535"],"related":[],"title":"Apache Syncope: non-admin users can configure impersonation for surrogate login","description":"Improper Privilege Management vulnerability in Apache Syncope.\n\n\n\nAuthProfile self-updates allow non-admin users to configure impersonation for WA surrogate authentication.\nThis issue affects Apache Syncope: from 3.0.12 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3.\n\n\n\nUsers are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.","summary":"Apache Syncope lets regular users change their own authentication profile to allow impersonation through WA surrogate authentication. An attacker with an ordinary account could then log in as other users.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-syncope","identity-management","package","self-hosted"],"not_affected_if":["default-config","versions-outside-range"],"how_to_check":"- Check the Apache Syncope version in use; affected versions are `3.0.12` through `3.0.16`, `4.0.0-M0` through `4.0.8`, and `4.1.0-M0` through `4.1.3`.\n- Confirm whether WA surrogate authentication is configured on the AuthProfile.","fix":"- Apache Syncope `4.0.x` line: upgrade to `4.0.9`\n- Apache Syncope `4.1.x` line: upgrade to `4.1.4`\n- Apache Syncope `3.0.x`: the sources do not name a fixed 3.0 release.","status":"open","published_at":"2026-11-02T14:17:35+00:00","first_seen_at":"2026-11-02T14:23:23+00:00","triaged_at":"2026-11-02T14:25:00+00:00","updated_at":"2026-11-02T14:25:00+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-02T14:25:00Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Syncope `4.0.x` line: upgrade to `4.0.9`\n- Apache Syncope `4.1.x` line: upgrade to `4.1.4`\n- Apache Syncope `3.0.x`: the sources do not name a fixed 3.0 release.","reach":"network","title":"Apache Syncope: non-admin users can configure impersonation for surrogate login","impact":"high","summary":"Apache Syncope lets regular users change their own authentication profile to allow impersonation through WA surrogate authentication. An attacker with an ordinary account could then log in as other users.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-syncope","identity-management","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated user impersonates other accounts through surrogate login","analyst_note":"Confirm the fixed 3.0.x release and whether WA surrogate authentication is on by default; NVD entry alone was the source.","how_to_check":"- Check the Apache Syncope version in use; affected versions are `3.0.12` through `3.0.16`, `4.0.0-M0` through `4.0.8`, and `4.1.0-M0` through `4.1.3`.\n- Confirm whether WA surrogate authentication is configured on the AuthProfile.","plain_action":"","needs_analyst":true,"not_affected_if":["default-config","versions-outside-range"],"who_is_affected":"Teams running Apache Syncope identity management in the affected version ranges that use WA surrogate authentication are exposed, since regular users can edit their own AuthProfile to enable impersonation. Deployments on other versions, or without surrogate authentication in use, are likely not affected; the sources do not say more.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000741,"input_tokens":4165,"output_tokens":650,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-110535':15A,18A '-2026':14A,17A '3.0.12':88C '3.0.16':90C '4.0.0':92C '4.0.8':95C '4.0.9':108C '4.1.0':97C '4.1.3':100C '4.1.4':109C 'account':51B 'admin':5A,73C 'affect':84C 'allow':40B,70C 'apach':1A,20B,29B,64C,85C 'apache-syncop':19B 'attack':47B 'authent':37B,45B,81C 'authprofil':66C 'chang':34B 'configur':8A,76C 'could':52B 'cve':13A,16A 'fix':111C 'host':28B 'ident':23B 'identity-manag':22B 'imperson':9A,41B,77C 'improp':59C 'issu':83C,113C 'let':31B 'log':54B 'login':12A 'm0':93C,98C 'manag':24B,61C 'non':4A,72C 'non-admin':3A,71C 'ordinari':50B 'packag':25B 'privileg':60C 'profil':38B 'recommend':103C 'regular':32B 'self':27B,68C 'self-host':26B 'self-upd':67C 'surrog':11A,44B,80C 'syncop':2A,21B,30B,65C,86C 'updat':69C 'upgrad':105C 'user':6A,33B,58B,74C,101C 'version':107C 'vulner':62C 'wa':43B,79C","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache Syncope identity management in the affected version ranges that use WA surrogate authentication are exposed, since regular users can edit their own AuthProfile to enable impersonation. Deployments on other versions, or without surrogate authentication in use, are likely not affected; the sources do not say more.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apachesyncope","high","identitymanagement","package","selfhosted"],"first_public_at":"2026-11-02T14:17:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110535","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110535","severity":null,"published_at":"2026-11-02T14:17:35+00:00","modified_at":"2026-11-02T14:17:35+00:00","first_seen_at":"2026-11-02T14:23:23+00:00","fetched_at":"2026-11-02T14:23:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}