CVE-2026-75030

published 2026-09-14

CVE-2026-75030: Missing Authorization vulnerability in Apache Syncope. An administrator with task execution entitlements might be able to mass (de)provision group members…

Priority P3 57 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

Missing Authorization vulnerability in Apache Syncope.

An administrator with task execution entitlements might be able to mass (de)provision group members, regardless of their group-related administration capabilities.

This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2.

Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
apache_software_foundation	apache_syncope	3.0.0-M0 – 3.0.16	—
apache_software_foundation	apache_syncope	4.0.0-M0 – 4.0.7	—
apache_software_foundation	apache_syncope	4.1.0-M0 – 4.1.2	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-862