CVE-2026-62183

{
  "id": "CVE-2026-62183",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-20T15:16:44.860",
  "lastModified": "2026-10-24T20:10:00.137",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Privilege Management vulnerability in Apache Syncope.\n\nWhen:\n\n* the all-Java user workflow adapter is configured, or\n* the Flowable user workflow adapter is configured, bearing a BPMN definition not requiring admin approval for user self registration of self update requests\n\nthe following scenario could happen.\nA REST API call can allow the user to grant themselves one or more of defined Roles, thus gaining their Entitlements and becoming in fact an administrator; the actual Entitlements gained depend on the Roles that are effectively defined on the specific Syncope deployment.\n\n\nThis issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1.\n\nUsers are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de Gestión Inadecuada de Privilegios en Apache Syncope.\n\nCuando:\n\n* el adaptador de flujo de trabajo de usuario all-Java está configurado, o\n* el adaptador de flujo de trabajo de usuario Flowable está configurado, que contiene una definición BPMN que no requiere aprobación de administrador para el auto-registro de usuario o solicitudes de auto-actualización\n\nel siguiente escenario podría ocurrir.\nUna llamada a la API REST puede permitir al usuario otorgarse a sí mismo uno o más de los Roles definidos, obteniendo así sus Privilegios y convirtiéndose de hecho en un administrador; los Privilegios reales obtenidos dependen de los Roles que están efectivamente definidos en la implementación específica de Syncope.\n\nEste problema afecta a Apache Syncope: desde 3.0.0-M0 hasta 3.0.16, desde 4.0.0-M0 hasta 4.0.6, desde 4.1.0-M0 hasta 4.1.1.\n\nSe recomienda a los usuarios actualizar a la versión 4.0.7 / 4.1.2, que corrige este problema."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Syncope",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "packageName": "org.apache.syncope.core:syncope-core-workflow-java",
          "versions": [
            {
              "version": "3.0.0-M0",
              "lessThanOrEqual": "3.0.16",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "4.0.0-M0",
              "lessThanOrEqual": "4.0.6",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "4.1.0-M0",
              "lessThanOrEqual": "4.1.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-21T14:37:27.827383Z",
          "id": "CVE-2026-62183",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:syncope:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "3.0.0",
              "versionEndIncluding": "3.0.16",
              "matchCriteriaId": "81A43F1F-85A5-405B-B28A-CA2AE38D5454"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:syncope:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.0.0",
              "versionEndExcluding": "4.0.7",
              "matchCriteriaId": "02A0BB79-9446-40A4-B03C-2316741BB78F"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:syncope:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.1.0",
              "versionEndExcluding": "4.1.2",
              "matchCriteriaId": "000C1E11-62E0-4321-8648-BB7513E8E318"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://lists.apache.org/thread/6r8cngvy43y2yk4jj3w060dt8vx0yzpr",
      "source": "[email protected]",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ]
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/07/20/9",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ]
    }
  ]
}