CVE-2026-73178

This flaw can expose the digital login tickets used by people already signed in to Apache Syncope. It is like an administrator being able to copy a master key from another administrator’s keyring and use it to enter areas they were not personally authorized to access.

This matters to you if you run Apache Syncope to manage identities, user accounts, or access to business systems. The attacker must already have an administrator login with sufficient permissions, and the risk applies when Apache Syncope administrative endpoints are exposed.

Treat this as urgent because a compromised or overly privileged administrator account can be used to take over more powerful accounts. There is no confirmed public exploitation or known public exploit code, but the flaw can expose high-privilege access and should be contained and remediated promptly.

Confirm the deployed Apache Syncope branch and version, then determine whether administrator-accessible REST endpoints are reachable from untrusted networks. Move 4.0 installations to 4.0.8 or later and 4.1 installations to 4.1.3 or later; for the 3.0 branch, move to a supported fixed release because the available findings do not identify a specific 3.0 fixed version.

Before upgrading, review release notes and test the upgrade in a staging environment, especially where custom integrations use Syncope REST APIs. If patching is delayed, restrict administrative REST access to a management network, reduce administrator entitlements to the minimum necessary, and rotate or invalidate active access tokens where operationally feasible.

Review logs for unusual token-list REST requests, administrator actions performed by unexpected accounts, and API activity using accounts with elevated entitlements. CISA has not listed this CVE in KEV, so there is no KEV due date.

CVE-2026-73178 is rated CVSS 7.5 High (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and is classified as CWE-200, Exposure of Sensitive Information to an Unauthorized Actor. In practice, exploitation requires valid administrator credentials with adequate entitlements; the exposed REST response includes raw signed JWT bodies that can be replayed to impersonate users with higher privileges. The affected ranges are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 when administrative endpoints are exposed. EPSS is 0.4% and flat at the 35th percentile; the CVE is not in CISA KEV, with no clear dated in-the-wild exploitation claim and no public exploit code recorded.