Threats Tagged 'cve-2026-62183'

An Improper Privilege Management vulnerability exists in Apache Syncope versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1. When configured with either the all-Java or Flowable user workflow adapter using a BPMN definition that does not require admin approval for user self-registration or self-update requests, a REST API call can allow users to grant themselves one or more roles. This effectively grants them the entitlements of those roles, potentially elevating their privileges to administrator level depending on the deployment's role definitions. Users are advised to upgrade to versions 4.0.7 or 4.1.2, which address this issue.

Improper Privilege Management vulnerability in Apache Syncope. When: * the all-Java user workflow adapter is configured, or * the Flowable user workflow adapter is configured, bearing a BPMN definition not requiring admin approval for user self registration of self update requests the following scenario could happen. A REST API call can allow the user to grant themselves one or more of defined Roles, thus gaining their Entitlements and becoming in fact an administrator; the actual Entitlements gained depend on the Roles that are effectively defined on the specific Syncope deployment. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue.