Auth bypass in Apache Software Foundation Syncope
CVE-2026-77181
Incorrect Authorization vulnerability in Apache Syncope. An administrator with ClientApp's update entitlement is unable to perform the related operation, while ClientApp's create entitlement is checked both for create and update operations on ClientApp. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
Vulnerability class: Broken Access Control
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
Weakness classification (CWE)
References
- security@apache.org (vendor-advisory)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2026-77181?
- CVE-2026-77181 is a critical-severity vulnerability in Apache Software Foundation Syncope, classified under Incorrect Authorization. CVSS score: 9.8/10. Published 2026-09-14.
- How severe is CVE-2026-77181?
- Critical severity. CVSS v3 base score is 9.8 out of 10.