Cyber ·
CVE-2026-110535: privilege escalation in Apache Syncope via AuthProfile
Disclosed on November 2, 2026, this important-severity flaw lets non-administrator users configure impersonation for WA substitute authentication through their own AuthProfile updates.
Source: advisory published by Francesco Chicchiriccò on the oss-sec feed on November 2, 2026, in machine translation. Severity is rated important. Affected Apache Syncope versions: 3.0.12 through 3.0.16; 4.0.0-M0 through 4.0.8; and 4.1.0-M0 through 4.1.3. The issue is improper privilege management: self-updates of AuthProfile let non-administrator users configure impersonation for WA substitute authentication.
To verify, consult the original advisory on the oss-sec feed of the seclists archive, fourth quarter of 2026, message 471, and check the Syncope version you run. If you are in an affected range, review the project's fix notes before upgrading. The text gives no exploitation details beyond what is stated.