Threats tagged 'ghsa-w7wp-qc67-vgc8'

Apache Syncope contains an incorrect privilege assignment vulnerability that allows an attacker to gain admin privileges after successful authentication with a low-privilege JWT if the JWKS settings are disclosed. This affects versions from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Upgrading to versions 4.0.8 or 4.1.3 mitigates this issue.