As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-113511: Apache Syncope: Delegated administration boundaries can be bypassed for Realm update
CVE-2026-113511 is an authorization bypass vulnerability in Apache Syncope that allows delegated administrators to relocate Realm subtrees across administrative boundaries without proper permission checks. The flaw affects versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, and 4.1.0-M0 through 4.1.3. A delegated administrator can move a Realm to an administrative realm where they lack authorization.
Why it matters: Organizations running Apache Syncope must patch affected versions immediately; delegated admins could escalate privileges by repositioning administrative boundaries, potentially gaining unauthorized access to sensitive realms.
- Source published
- First seen by Cybersecurity Tracker