CVE-2026-73668

Apache Syncope contains an incorrect authorization vulnerability that allows an administrator with valid entitlements in one Realm to read, via REST, the full Connector configuration —including confidential ConnId bundle properties —scoped to a different Realm. This enables the administrator to e...