CVE-2026-62183— Apache Syncope: User self-service privilege escalation
Quick assessment
Affected
Apache Software Foundation Apache Syncope
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache syncope是美国Apache基金会开源的一套身份管理自动化工具。 Apache Syncope 3.0.0-M0版至3.0.16版、4.0.0-M0版至4.0.6版和4.1.0-M0版至4.1.1版存在权限许可和访问控制问题漏洞，该漏洞源于权限管理不当，当配置全Java用户工作流适配器或Flowable用户工作流适配器且BPMN定义不需要管理员批准用户自我注册或自我更新请求时，通过REST API调用可能允许用户授予自身一个或多个已定义角色，从而获取权限并成为管理员，实际获取的权限取决于
In-the-Wild Activity Observed
github_trending · low
Affected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache Syncope | 3.0.0-M0≤ 3.0.16 |
affected |
4.0.0-M0≤ 4.0.6 |
affected | ||
4.1.0-M0≤ 4.1.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-62183
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Syncope: User self-service privilege escalation
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Privilege Management vulnerability in Apache Syncope.
When:
* the all-Java user workflow adapter is configured, or
* the Flowable user workflow adapter is configured, bearing a BPMN definition not requiring admin approval for user self registration of self update requests
the following scenario could happen.
A REST API call can allow the user to grant themselves one or more of defined Roles, thus gaining their Entitlements and becoming in fact an administrator; the actual Entitlements gained depend on the Roles that are effectively defined on the specific Syncope deployment.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1.
Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
特权管理不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Syncope 权限许可和访问控制问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache syncope是美国Apache基金会开源的一套身份管理自动化工具。 Apache Syncope 3.0.0-M0版至3.0.16版、4.0.0-M0版至4.0.6版和4.1.0-M0版至4.1.1版存在权限许可和访问控制问题漏洞，该漏洞源于权限管理不当，当配置全Java用户工作流适配器或Flowable用户工作流适配器且BPMN定义不需要管理员批准用户自我注册或自我更新请求时，通过REST API调用可能允许用户授予自身一个或多个已定义角色，从而获取权限并成为管理员，实际获取的权限取决于
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Syncope | 3.0.0-M0 ~ 3.0.16 | - |
|
II. Public POCs for CVE-2026-62183
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-62183
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-62183 (1)
Same Patch Batch · Apache Software Foundation · 2026-07-20 · 10 CVEs total
| CVE-2026-56452 | 7.5 HIGH | Apache MINA SSHD: Path traversal in SCP file reception |
| CVE-2026-56624 | 7.3 HIGH | Apache MINA SSHD: SSH certificate options lack validations |
| CVE-2026-56623 | 7.1 HIGH | Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git on Windows |
| CVE-2026-58624 | 5.4 MEDIUM | Apache MINA SSHD: Remote execution of JGit commands can write files on the server |
| CVE-2026-63071 | Apache Syncope: RCE via Groovy Sandbox bypass | |
| CVE-2026-53405 | Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask | |
| CVE-2026-53421 | Apache Syncope: Remote Code Execution via Scripted Connector | |
| CVE-2026-57308 | Apache Syncope: SQL injection vulnerability in Audit Events search | |
| CVE-2026-62418 | Apache Syncope: Low-privileged authenticated SSRF in Connectors and Resources check |
IV. Related Vulnerabilities
Same product: Apache Syncope
-
CVE-2026-73191
Apache Syncope: CAS service URL injection via Forwarded HTTP -
CVE-2026-73195
Apache Syncope: CSV export spreadsheet formula injection -
CVE-2026-73236
Apache Syncope: Cross-Realm authorization bypass in delegate -
CVE-2026-73370
Apache Syncope: Cross-Realm boundaries reconciliation bypass -
CVE-2026-73178
Apache Syncope: JWT Access Token takeover
Same vendor: Apache Software Foundation
-
CVE-2026-70410
Apache Calcite Avatica: Unrestricted class initialization wh -
CVE-2026-94301
Apache MINA: CVE-2026-47065 resolveProxyClass fix missing fr -
CVE-2026-86473
Apache Airflow: Logout ignores a presented Authorization bea -
CVE-2026-75158
Apache Airflow: Assets events API returns asset events for e -
CVE-2026-82355
Apache Airflow: Session cookie silently overrides explicit A
Same weakness: CWE-269
-
CVE-2026-17472
Multiple Vulnerabilities in IBM Concert Software -
CVE-2026-83597
Netdata: Local Privilege Escalation in Netdata Windows Agent -
CVE-2026-83598
Netdata: Local Privilege Escalation in Netdata Agent Windows -
CVE-2026-19915
HP Support Assistant - Local Escalation of Privilege -
CVE-2026-12470
CMP <= 4.1.17 - Authenticated (Editor+) Privilege Escalation
V. Comments for CVE-2026-62183
No comments yet