CVE-2026-78336 is a vulnerability in Apache Syncope that allows any authenticated user to query the list of available OpenID Connect (OIDC) providers configured for Single Sign-On (SSO) via the Console and Enduser interfaces. The response payload includes all configuration settings, notably client secrets, without restricting access based on user entitlements. This information disclosure affects Apache Syncope versions from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. The issue is resolved in versions 4.0.8 and 4.1.3.

The vulnerability leads to unauthorized disclosure of sensitive information, specifically client secrets for OIDC providers, to any authenticated user regardless of their permissions. This can compromise the confidentiality of authentication credentials and potentially facilitate further attacks against the affected system or its integrated services. The CVSS score of 7.5 (high) reflects the significant confidentiality impact with no required user interaction and network attack vector.

Users should upgrade Apache Syncope to version 4.0.8 or 4.1.3, which contain fixes for this vulnerability. No other mitigation is indicated by the vendor advisory. Patch status is confirmed by the vendor's recommendation to upgrade to these fixed versions.