CVE-2026-78330

EUVD-2026-77438
Incorrect privilege assignment vulnerability in Apache Syncope.

When the configured JWKS settings for internal JWT authentication are disclosed (at least protocol and key), an attacker can obtain admin privileges after completing a successful authentication and obtaining a valid low-privileges JWT.



This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2.



Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
apacheCNA
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 50.69%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
apachesyncope
𝑥
≤ 3.0.16
CNA
apachesyncope
𝑥
≤ 4.0.7
CNA
apachesyncope
𝑥
≤ 4.1.2
CNA
Common Weakness Enumeration
References
https://lists.apache.org/thread/vkqmmpwcdson285vtmzpbj9psw35hyo9
http://www.openwall.com/lists/oss-security/2026/09/14/19