CYBERSECURITYTRACKER
Permanent story citation

CVE-2026-110535: Apache Syncope: AuthProfile value escalation via self-service update

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 12111

As cited

Copy frozen at (site build).

vulnerabilities

CVE-2026-110535: Apache Syncope: AuthProfile value escalation via self-service update

CVE-2026-110535 is an improper privilege management vulnerability in Apache Syncope that allows non-admin users to configure impersonation for Web Authentication surrogate authentication through AuthProfile self-updates. The flaw affects Syncope versions 3.0.12 through 3.0.16, 4.0.0-M0 through 4.0.8, and 4.1.0-M0 through 4.1.3. Organizations running affected versions should prioritize patching to prevent privilege escalation.

Why it matters: Syncope users face immediate risk of privilege escalation if running vulnerable versions; patch availability and version upgrade guidance are needed to remediate the impersonation capability.

CVEsCVE-2026-110535
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary

Open in glossary