CVE-2026-62183 is an improper privilege management vulnerability in Apache Syncope. It occurs when the all-Java or Flowable user workflow adapters are configured with BPMN definitions that do not require administrative approval for user self-registration or self-update requests. Under these conditions, an attacker can exploit a REST API call to assign themselves one or more roles, thereby gaining the associated entitlements and effectively becoming an administrator. The vulnerability affects Apache Syncope versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1. The vendor recommends upgrading to versions 4.0.7 or 4.1.2 to remediate the issue.

Successful exploitation allows an unauthenticated or low-privileged user to escalate privileges by assigning themselves administrative roles via a REST API call. This leads to full compromise of the affected Apache Syncope deployment, including confidentiality, integrity, and availability impacts. The CVSS v3.1 base score is 9.8 (critical), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

A fix is available. Users should upgrade Apache Syncope to version 4.0.7 or 4.1.2, which address this vulnerability. No other mitigations are indicated by the vendor advisory. Patch status is confirmed by the vendor's recommended upgrade versions.