CVE-2026-73470 is an improper privilege management vulnerability in Apache Syncope. It allows a user with delegation rights to create or update delegations with roles that the user does not own or that fall outside the realm subtree for which delegation management was granted. This could lead to unauthorized privilege escalation within the system. The vulnerability affects Apache Syncope versions >=3.0.0-M0 <=3.0.16, >=4.0.0-M0 <=4.0.7, and >=4.1.0-M0 <=4.1.2. The vendor has released fixed versions 4.0.8 and 4.1.3 to address this issue.

The vulnerability allows users to assign roles beyond their authorized scope, potentially granting unauthorized privileges and access within Apache Syncope. This could undermine access control policies and lead to privilege escalation. No known exploits in the wild have been reported.

Users should upgrade Apache Syncope to version 4.0.8 or 4.1.3, where this vulnerability has been fixed. No other mitigation steps are indicated by the vendor advisory.