Cyber ·
CVE-2026-113511: delegated administration in Apache Syncope can bypass Realm boundaries
Security advisory on Apache Syncope: a delegated administrator can move a Realm subtree beyond administrative boundaries without authorization for the destination. Reported severity: important.
The advisory, published on 02 November 2026 from the oss-sec feed, describes CVE-2026-113511 in Apache Syncope. According to the text, a delegated administrator can relocate a Realm subtree beyond administrative boundaries without permission for the destination. The reported severity is important. The flaw is classified as an authorization bypass through a user-controlled key.
The listed affected versions are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, and 4.1.0-M0 through 4.1.3. The received text is a machine translation and is truncated in the section on exact scope, so the version list and fixed releases must be confirmed in the project's original advisory. The source reports no active exploitation and no published fix.
To verify, compare the Apache Syncope version in use with the list above, then check the original advisory and the project's release notes before making any decision.
Relevance for Rota Nacional: this is an access control problem in an identity management system, and Rota Nacional does not fix or replace that software. If your team uses AI to study the advisory, do not paste credentials, real configurations, or personal data. The platform detects CPF, CNPJ, e-mail, phone numbers, and person names before any model runs and applies the organization's policy, using markers, removal, or a block.