CVE-2026-62183

{"id": "CVE-2026-62183", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-62183", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-21T14:37:27.827383Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Syncope", "versions": [{"status": "affected", "version": "3.0.0-M0", "versionType": "semver", "lessThanOrEqual": "3.0.16"}, {"status": "affected", "version": "4.0.0-M0", "versionType": "semver", "lessThanOrEqual": "4.0.6"}, {"status": "affected", "version": "4.1.0-M0", "versionType": "semver", "lessThanOrEqual": "4.1.1"}], "packageName": "org.apache.syncope.core:syncope-core-workflow-java", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}]}], "published": "2026-07-20T15:16:44.860", "references": [{"url": "https://lists.apache.org/thread/6r8cngvy43y2yk4jj3w060dt8vx0yzpr", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/20/9", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "Improper Privilege Management vulnerability in Apache Syncope.\n\nWhen:\n\n* the all-Java user workflow adapter is configured, or\n* the Flowable user workflow adapter is configured, bearing a BPMN definition not requiring admin approval for user self registration of self update requests\n\nthe following scenario could happen.\nA REST API call can allow the user to grant themselves one or more of defined Roles, thus gaining their Entitlements and becoming in fact an administrator; the actual Entitlements gained depend on the Roles that are effectively defined on the specific Syncope deployment.\n\n\nThis issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1.\n\nUsers are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue."}, {"lang": "es", "value": "Vulnerabilidad de Gesti\u00f3n Inadecuada de Privilegios en Apache Syncope.\n\nCuando:\n\n* el adaptador de flujo de trabajo de usuario all-Java est\u00e1 configurado, o\n* el adaptador de flujo de trabajo de usuario Flowable est\u00e1 configurado, que contiene una definici\u00f3n BPMN que no requiere aprobaci\u00f3n de administrador para el auto-registro de usuario o solicitudes de auto-actualizaci\u00f3n\n\nel siguiente escenario podr\u00eda ocurrir.\nUna llamada a la API REST puede permitir al usuario otorgarse a s\u00ed mismo uno o m\u00e1s de los Roles definidos, obteniendo as\u00ed sus Privilegios y convirti\u00e9ndose de hecho en un administrador; los Privilegios reales obtenidos dependen de los Roles que est\u00e1n efectivamente definidos en la implementaci\u00f3n espec\u00edfica de Syncope.\n\nEste problema afecta a Apache Syncope: desde 3.0.0-M0 hasta 3.0.16, desde 4.0.0-M0 hasta 4.0.6, desde 4.1.0-M0 hasta 4.1.1.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 4.0.7 / 4.1.2, que corrige este problema."}], "lastModified": "2026-10-24T20:10:00.137", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:syncope:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "81A43F1F-85A5-405B-B28A-CA2AE38D5454", "versionEndIncluding": "3.0.16", "versionStartIncluding": "3.0.0"}, {"criteria": "cpe:2.3:a:apache:syncope:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "02A0BB79-9446-40A4-B03C-2316741BB78F", "versionEndExcluding": "4.0.7", "versionStartIncluding": "4.0.0"}, {"criteria": "cpe:2.3:a:apache:syncope:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "000C1E11-62E0-4321-8648-BB7513E8E318", "versionEndExcluding": "4.1.2", "versionStartIncluding": "4.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}