As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-78330: Apache Syncope: Privilege escalation for admin user via JWT authentication
Apache Syncope versions 3.0.0 through 4.1.2 contain a privilege escalation vulnerability in JWT authentication that allows admin users to gain elevated privileges through incorrect privilege assignment in JWKS settings. The moderate-severity issue (CVE-2026-78330) affects multiple release branches of the identity and access management platform.
Why it matters: Organizations running Apache Syncope must patch affected versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, or 4.1.0-M0 through 4.1.2 to prevent authenticated admin users from escalating privileges.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-78330: Apache Syncope: Privilege escalation for admin user via JWT authentication
CVE-2026-78330 affects Apache Syncope versions 3.0.0 through 4.1.2 and stems from incorrect privilege assignment in JWT authentication handling. An authenticated attacker with admin user access could escalate privileges through misconfigured JWKS settings in the internal JWT authentication mechanism.
Why it matters: Administrators of Apache Syncope deployments must patch affected versions to prevent privilege escalation attacks by authenticated users with admin credentials; the high CVSS score (9.8) indicates severe impact to confidentiality, integrity, and availability.
- Source published
- First seen by Cybersecurity Tracker