Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization due to improper handling of Realm hierarchy checks in delegated administration. An attacker can gain unauthorized access to resources in sibling Realms by exploiting prefix-based matching in the authorization...

CVE-2026-73236

Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks are based on Realm hierarchy and enforced via prefix matches. Due to incorrect implementation, two sibling Realms whose names begin with the same string cannot be correctly distinguished, resulting i...

CVE-2026-73236 Apache Syncope: Cross-Realm authorization bypass in delegated administration

Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks are based on Realm hierarchy and enforced via prefix matches. Due to incorrect implementation, two sibling Realms whose names begin with the same string cannot be correctly distinguished, resulting i...

CVE-2026-73236

Apache Syncope is vulnerable to an incorrect authorization issue due to a flawed implementation of delegated administration security checks. The system relies on Realm hierarchy and prefix matches ; however, it fails to correctly distinguish between two sibling Realms that share the same initial ...

CVE-2026-73236: Incorrect Authorization

Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks are based on Realm hierarchy and enforced via prefix matches. Due to incorrect implementation, two sibling Realms whose names begin with the same string cannot be correctly distinguished, resulting i...