CVE-2026-73236 Apache Syncope: Cross-Realm authorization bypass in delegated administration

Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks are based on Realm hierarchy and enforced via prefix matches. Due to incorrect implementation, two sibling Realms whose names begin with the same string cannot be correctly distinguished, resulting i...

CVE-2026-73236

Apache Syncope is affected by an incorrect authorization flaw in its delegated administration feature. Security checks enforce Realm hierarchy via prefix matches on Realm names. Due to an incorrect implementation, two sibling Realms whose names begin with the same string cannot be correctly disti...

CVE-2026-73236 Apache Syncope: Cross-Realm authorization bypass in delegated administration

Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks are based on Realm hierarchy and enforced via prefix matches. Due to incorrect implementation, two sibling Realms whose names begin with the same string cannot be correctly distinguished, resulting i...

EUVD-2026-77474

Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks are based on Realm hierarchy and enforced via prefix matches. Due to incorrect implementation, two sibling Realms whose names begin with the same string cannot be correctly distinguished, resulting i...

CVE-2026-73668

Incorrect Authorization vulnerability in Apache Syncope. An administrator with adequate entitlements in a given Realm may be able to read via REST the full Connector configuration, confidential properties included, scoped in another Realm and thus be able to effectively duplicate such Connector...

CVE-2026-73470

Improper Privilege Management vulnerability in Apache Syncope. Delegations can be created or updated with Roles not owned by the delegating User, or not for the same Realm subtree under the delegation management was granted for. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, fro...

CVE-2026-73370

CVE-2026-73370 is an Incorrect Authorization vulnerability in Apache Syncope . The Reconciliation service's pull and push operations perform delegated administration security checks that are incomplete, allowing administrators without adequate entitlements to make authorized calls—effectively byp...

CVE-2026-73370 Apache Syncope: Cross-Realm boundaries reconciliation bypass

Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks performed by Reconciliation service's pull and push, being incomplete, could accept calls by administrator not provided with adequate entitlements. This issue affects Apache Syncope: from 3.0.0-M0...

EUVD-2026-77464

Improper Privilege Management vulnerability in Apache Syncope. Delegations can be created or updated with Roles not owned by the delegating User, or not for the same Realm subtree under the delegation management was granted for. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, fro...

CVE-2026-73470 Apache Syncope: Delegating users can grant unowned Roles

Improper Privilege Management vulnerability in Apache Syncope. Delegations can be created or updated with Roles not owned by the delegating User, or not for the same Realm subtree under the delegation management was granted for. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, fro...

CVE-2026-73579 Apache Syncope: Non-recursive Any search could skip Realms restrictions

Incorrect Authorization vulnerability in Apache Syncope. Any search requests are transformed into SQL, Neo4J or Elasticsearch / Opensearch queries, depending on the actual deployment configuration. An important component of such transformation is the Realms filter, which ensures that the search...

EUVD-2026-77458

Incorrect Authorization vulnerability in Apache Syncope. An administrator with adequate entitlements in a given Realm may be able to read via REST the full Connector configuration, confidential properties included, scoped in another Realm and thus be able to effectively duplicate such Connector...

CVE-2026-73668 Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values

Incorrect Authorization vulnerability in Apache Syncope. An administrator with adequate entitlements in a given Realm may be able to read via REST the full Connector configuration, confidential properties included, scoped in another Realm and thus be able to effectively duplicate such Connector...

CVE-2026-73668

Apache Syncope contains an Incorrect Authorization flaw that allows an administrator with entitlements in one Realm to read the full Connector configuration (including confidential properties) of another Realm via the REST API . This cross-realm disclosure effectively permits an attacker to dupli...

Astra Linux – Vulnerability in Tomcat9

An improper authorization vulnerability in Apache Tomcat occurs due to incorrect use of security-role-ref definitions as role aliases within the Realm, in addition to their proper use in Request.isUserInRole. This issue affects Apache Tomcat versions from 11.0.0-M1 through 11.0.24, from 10.1.0-M1...

Astra Linux – Vulnerability in Firefox

Under certain circumstances, calling the bind function might result in an incorrect realm being assigned. This could create a vulnerability related to JavaScript-implemented sandboxes, such as SES. This vulnerability affects Firefox for Android 112, Firefox 112, and Focus for Android 112...

Astra Linux – Vulnerability in Firefox and Thunderbird

If an out-of-memory condition occurs when creating a JavaScript global, the JavaScript realm may be deleted, while references to it continue to exist within a BaseShape. This could lead to a use-after-free situation, potentially causing a exploitable crash. This vulnerability affects Firefox ESR...

Astra Linux – Vulnerability in Tomcat9

Improper handling of the case sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: versions from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, and from 7.0.0 through 7.0.109. Older,...

Astra Linux – Vulnerability in python-kdcproxy

If kdcproxy receives a request for a realm whose configuration does not define any server addresses, it will, by default, query DNS zone records that match the requested realm name. This creates a server-side request-forgery vulnerability, as an attacker could send a request for a realm that...

PT-2026-91189

Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks are based on Realm hierarchy and enforced via prefix matches. Due to incorrect implementation, two sibling Realms whose names begin with the same string cannot be correctly distinguished, resulting i...