CVE-2026-75030 — Apache Syncope: Incomplete authorization checks for Group members deprovisioning

Description (CNA)

Missing Authorization vulnerability in Apache Syncope. An administrator with task execution entitlements might be able to mass (de)provision group members, regardless of their group-related administration capabilities. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Syncope	affected 3.0.0-M0 through 3.0.16; affected 4.0.0-M0 through 4.0.7; affected 4.1.0-M0 through 4.1.2

CWE

CWE-862

References

https://lists.apache.org/thread/94rx818lj8sjx85h8pory9xcsst9xvot

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/09/14/13

CISA-ADP

No English description supplied.

No references supplied.