CVE-2026-73668

Apache Syncope contains an Incorrect Authorization flaw that allows an administrator with entitlements in one Realm to read the full Connector configuration (including confidential properties) of another Realm via the REST API . This cross-realm disclosure effectively permits an attacker to dupli...