---
id: CVE-2026-78330
title: >-
  Incorrect privilege assignment vulnerability in Apache Syncope.


  When the configured JWKS settings for internal JWT authentication are
  disclosed (at least protocol and key), an attacker can obtain admin privileges
  after completing a succ…
summary: >-
  Incorrect privilege assignment vulnerability in Apache Syncope.


  When the configured JWKS settings for internal JWT authentication are
  disclosed (at least protocol and key), an attacker can obtain admin privileges
  after completing a succ…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-266
vendor: Apache Software Foundation
product: 'org.apache.syncope.core:syncope-core-spring'
affected:
  - 'org.apache.syncope.core:syncope-core-spring >= 3.0.0-M0 <= 3.0.16'
  - 'org.apache.syncope.core:syncope-core-spring >= 4.0.0-M0 <= 4.0.7'
  - 'org.apache.syncope.core:syncope-core-spring >= 4.1.0-M0 <= 4.1.2'
published: '2026-09-14'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T20:58:48.430'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-78330'
references:
  - url: 'https://lists.apache.org/thread/vkqmmpwcdson285vtmzpbj9psw35hyo9'
    label: security@apache.org
  - url: 'http://www.openwall.com/lists/oss-security/2026/09/14/19'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-09-14T19:19:17.751065Z'
ingestedAt: '2026-09-14T15:23:07.432Z'
epss: 0.00642
epssPercentile: 0.48517
---

## Overview

Incorrect privilege assignment vulnerability in Apache Syncope.

When the configured JWKS settings for internal JWT authentication are disclosed (at least protocol and key), an attacker can obtain admin privileges after completing a successful authentication and obtaining a valid low-privileges JWT.



This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2.



Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.