Live › vulnerability › CVE-2026-113511
A delegated administrator can move a Realm subtree into an administrative realm they have no permission for. This lets them change access boundaries beyond what they were granted.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 14:23 UTC. All times on this page are UTC.
Organizations running Apache Syncope for identity and user provisioning that delegate realm administration to other administrators. Exposure depends on whether delegated admins can relocate realms; installations without delegated realm administrators are less exposed. The sources do not say whether default configurations are affected.
No product ranges from the sources yet.
3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, 4.1.0-M0 through 4.1.3.4.0.9.4.1.4.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Authorization bypass through User-Controlled key vulnerability in Apache Syncope.
A delegated administrator can relocate a Realm subtree across administrative realm boundaries without permission for the destination This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3.
Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-113511")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.