CVE-2026-73178
Last modified
CVE-2026-73178 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Syncope. An administrator with adequate entitlements can get access via REST to the list of existing Access Tokens, including their signed JWT body. These values can be then used to perform further REST requests, impersonating users with higher administration entitlements. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue..
Description
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Syncope. An administrator with adequate entitlements can get access via REST to the list of existing Access Tokens, including their signed JWT body. These values can be then used to perform further REST requests, impersonating users with higher administration entitlements. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Syncope | >= 3.0.0-M0, <= 3.0.16; >= 4.0.0-M0, <= 4.0.7; >= 4.1.0-M0, <= 4.1.2 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-73178?
How severe is CVE-2026-73178?
How do I fix CVE-2026-73178?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-73172Nozomi Networks Labs identified a CWE-78: Improper Neutraliz…9.3
- CVE-2026-73173Nozomi Networks Labs identified a CWE-306: Missing Authentic…8.8
- CVE-2026-73174Nozomi Networks Labs identified a CWE-319: Cleartext Transmi…8.7
- CVE-2026-73175Nozomi Networks Labs identified a CWE-400: Uncontrolled Reso…7.1
- CVE-2026-73176Nozomi Networks Labs identified a CWE-78: Improper Neutraliz…8.6
- CVE-2026-73177Nozomi Networks Labs identified a CWE-345: Insufficient Veri…8.6
- CVE-2026-7318A vulnerability was detected in elie mcp-project 0.1.0. The …5.9
- CVE-2026-73180Insufficient Session Expiration vulnerability in Apache Tomc…6.8
- CVE-2026-73181Unauthenticated Arbitrary File Download in Extra Product Opt…7.5
- CVE-2026-73182Unauthenticated Cross Site Scripting (XSS) in BBQ Pro <= 3.9…7.1
- CVE-2026-73183Unauthenticated SQL Injection in Maps Marker Pro <= 4.32 ver…9.3
- CVE-2026-73184Unauthenticated Cross Site Scripting (XSS) in Global Gallery…7.1
Are you affected by CVE-2026-73178?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST