← Vulnerability feed

Vulnerability record · CVE-2026-62183 · published 20 July 2026

CVE-2026-62183: Apache syncope improper privilege management vulnerability

Apache · Syncope

Improper Privilege Management vulnerability in Apache Syncope. When: * the all-Java user workflow adapter is configured, or * the Flowable user workflow adapter is configured, bearing a BPMN definition not requiring admin approval for user self registration of self update requests the following scenario could happen. A REST API call can allow the user to grant themselves one or more of defined Roles, thus gaining their Entitlements and becoming in fact an administrator; the actual Entitlements gained depend on the Roles that are effectively defined on the specific Syncope deployment. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue.

9.8 CVSS 3.1 Critical EPSS 0.69% · top 49.1% CWE-269 · Improper privilege management
9.8CVSS 3.1 base score
0.69%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
27 Jul 2026Last modified by NVD

Description

Improper Privilege Management vulnerability in Apache Syncope. When: * the all-Java user workflow adapter is configured, or * the Flowable user workflow adapter is configured, bearing a BPMN definition not requiring admin approval for user self registration of self update requests the following scenario could happen. A REST API call can allow the user to grant themselves one or more of defined Roles, thus gaining their Entitlements and becoming in fact an administrator; the actual Entitlements gained depend on the Roles that are effectively defined on the specific Syncope deployment. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://lists.apache.org/thread/6r8cngvy43y2yk4jj3w060dt8vx0yzpr Mailing ListVendor Advisory
http://www.openwall.com/lists/oss-security/2026/07/20/9 Mailing ListThird Party Advisory

Track CVE-2026-62183 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-63071Apache syncope vulnerabilityImproper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can creat…EPSS 0.75%9.8CVE-2026-57308Apache syncope sql injection vulnerabilityImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator with adequate …EPSS 0.83%9.8CVE-2026-53421Apache syncope vulnerabilityImproper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve remote code execu…EPSS 1.1%9.8CVE-2026-53405Apache syncope vulnerabilityImproper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN pro…EPSS 0.75%9.8CVE-2020-1961Apache syncope injection vulnerabilityVulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to 2.1.6, e…EPSS 4.8%9.8CVE-2020-1959Apache syncope expression language injection vulnerabilityA Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary Java EL expressions, leading …EPSS 5.0%8.1CVE-2026-62418Apache syncope server-side request forgery (ssrf) vulnerabilityLow-privileged authenticated Server-Side Request Forgery (SSRF) vulnerability in Apache Syncope via Connectors and Resources check. This issue affect…EPSS 0.47%7.5CVE-2025-65998Apache syncope vulnerabilityApache Syncope can be configured to store the user password values in the internal database with AES encryption, though this is not the default optio…EPSS 0.51%

Source: NIST National Vulnerability Database (record CVE-2026-62183), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.