---
id: "CVE-2026-110535"
kind: "vulnerability"
aliases: ["CVE-2026-110535"]
title: "Apache Syncope: non-admin users can configure impersonation for surrogate login"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-syncope", "identity-management", "package", "self-hosted"]
not_affected_if: ["default-config", "versions-outside-range"]
published_at: "2026-11-02T14:17:35+00:00"
first_seen_at: "2026-11-02T14:23:23+00:00"
updated_at: "2026-11-02T14:25:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110535", "first_seen_at": "2026-11-02T14:23:23+00:00"}]
---

# Apache Syncope: non-admin users can configure impersonation for surrogate login

Apache Syncope lets regular users change their own authentication profile to allow impersonation through WA surrogate authentication. An attacker with an ordinary account could then log in as other users.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Apache Syncope version in use; affected versions are `3.0.12` through `3.0.16`, `4.0.0-M0` through `4.0.8`, and `4.1.0-M0` through `4.1.3`.
- Confirm whether WA surrogate authentication is configured on the AuthProfile.

## Fix

- Apache Syncope `4.0.x` line: upgrade to `4.0.9`
- Apache Syncope `4.1.x` line: upgrade to `4.1.4`
- Apache Syncope `3.0.x`: the sources do not name a fixed 3.0 release.

## Timeline

- 2026-11-02T14:23:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110535

## From the sources

Improper Privilege Management vulnerability in Apache Syncope.



AuthProfile self-updates allow non-admin users to configure impersonation for WA surrogate authentication.
This issue affects Apache Syncope: from 3.0.12 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3.



Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_