CVE-2026-73178— Apache Syncope: JWT Access Token takeover
Quick assessment
Affected
Apache Software Foundation Apache Syncope
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Syncope 存在“敏感信息暴露给未授权角色”的漏洞。 拥有适当权限的管理员可通过 REST 接口获取现有访问令牌（Access Tokens）的列表，其中包括其签名的 JWT 主体内容。这些值可被用于发起进一步的 REST 请求，从而冒充具有更高管理权限的用户进行操作。 受此问题影响的 Apache Syncope 版本包括： 从 3.0.0-M0 到 3.0.16 从 4.0.0-M0 到 4.0.7 从 4.1.0-M0 到 4.1.2 建议用户升级到 4.0.8 / 4.1.3 版本，该版本
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud Storage
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-73178
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Syncope: JWT Access Token takeover
Source: CVE Program / CVE List V5
Vulnerability Description
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Syncope.
An administrator with adequate entitlements can get access via REST to the list of existing Access Tokens, including their signed JWT body.
These values can be then used to perform further REST requests, impersonating users with higher administration entitlements.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2.
Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Syncope | 3.0.0-M0 ~ 3.0.16 | - |
|
II. Public POCs for CVE-2026-73178
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-73178
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-73178 (1)
Same Patch Batch · Apache Software Foundation · 2026-09-14 · 39 CVEs total
| CVE-2026-82434 | 10.0 CRITICAL | Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential |
| CVE-2026-78330 | Apache Syncope: Privilege escalation for admin user via JWT authentication | |
| CVE-2026-73579 | Apache Syncope: Non-recursive Any search could skip Realms restrictions | |
| CVE-2026-75015 | Apache Syncope: Nested secrets leak cleartext into audit records readable | |
| CVE-2026-75030 | Apache Syncope: Incomplete authorization checks for Group members deprovisioning | |
| CVE-2026-77051 | Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search | |
| CVE-2026-73668 | Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values | |
| CVE-2026-77147 | Apache Syncope: Groovy Sandbox escape for empty CommandArgs | |
| CVE-2026-77181 | Apache Syncope: ClientApp update entitlement not effective | |
| CVE-2026-77883 | Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBui | |
| CVE-2026-78318 | Apache Syncope: Unauthenticated reflected XSS in Console and Enduser | |
| CVE-2026-73470 | Apache Syncope: Delegating users can grant unowned Roles | |
| CVE-2026-78336 | Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user | |
| CVE-2026-82232 | Apache Syncope: SQL injection via sort parameter in Task search | |
| CVE-2026-86460 | Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence | |
| CVE-2026-87779 | Apache Syncope: AES Secret Key disclosure via log output | |
| CVE-2026-87785 | Apache Syncope: JWT subject spoofing | |
| CVE-2026-87802 | Apache Syncope: SRA OAuth2 JWT signature verification bypass | |
| CVE-2026-68570 | Apache Doris: Authorization bypass leading to unauthorized data access | |
| CVE-2026-72524 | Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitr |
Showing top 20 of 39 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Apache Syncope
-
CVE-2026-73191
Apache Syncope: CAS service URL injection via Forwarded HTTP -
CVE-2026-73195
Apache Syncope: CSV export spreadsheet formula injection -
CVE-2026-73236
Apache Syncope: Cross-Realm authorization bypass in delegate -
CVE-2026-73370
Apache Syncope: Cross-Realm boundaries reconciliation bypass -
CVE-2026-73470
Apache Syncope: Delegating users can grant unowned Roles
Same vendor: Apache Software Foundation
-
CVE-2026-82427
Apache Storm Nimbus: Path Traversal as the Supervisor User v -
CVE-2026-82428
Apache Storm Client: Cross-Tenant Dependency Jar Substitutio -
CVE-2026-82429
Apache Storm Worker Launcher: Local Privilege Escalation to -
CVE-2026-82430
Apache Storm Worker Launcher: Local Privilege Escalation to -
CVE-2026-82431
Apache Storm Client: Authorization Bypass When nimbus.groups
Same weakness: CWE-200
-
CVE-2026-90936
Froxlor before 2.3.7 Information Disclosure via customer_ema -
CVE-2026-85188
Joomla Extension - regularlabs.com - Database data disclosur -
CVE-2026-90503
Chengdu Qilu Technology Ludashi ComputerZ_x64.sys sub_11008 -
CVE-2026-90550
WWBN AVideo Missing Authorization via mediaSession.json.php -
CVE-2026-90549
WWBN AVideo Missing Authorization via videosAndroid.json.php
V. Comments for CVE-2026-73178
No comments yet