Posted by Francesco Chicchiriccò on Nov 02 Severity: important Affected versions: - Apache Syncope 3.0.12 through 3.0.16 - Apache Syncope 4.0.0-M0 through 4.0.8 - Apache Syncope 4.1.0-M0 through 4.1.3 Description: Improper Privilege Management vulnerability in Apache Syncope. AuthProfile self-updates allow non-admin users to configure impersonation for WA surrogate authentication.
CVE-2026-110535: Apache Syncope: AuthProfile value escalation via self-service update
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/471
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
CVE-2026-113511: Apache Syncope: Delegated administration boundaries can be bypassed for Realm update
Posted by Francesco Chicchiriccò on Nov 02 Severity: important Affected versions: - Apache Syncope 3.0.0-M0 through 3.0.16 - Apache Syncope 4.0.0-M0 through 4.0.8 -…
CVE-2026-119641: Apache Oozie: workflow rerun bypasses the per-job ACL and reassigns ownership
Posted by Arnout Engelen on Nov 02 Severity: moderate Affected versions: - Apache Oozie: all versions Description: ** UNSUPPORTED WHEN ASSIGNED ** Improper input…
CVE-2026-119724: Apache JClouds: XML External Entity (XXE) in provider-response parsing
Posted by Arnout Engelen on Nov 02 Severity: moderate Affected versions: - Apache JClouds: all versions Description: ** UNSUPPORTED WHEN ASSIGNED ** Improper restriction…
CVE-2026-111959: Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads
Posted by Jeffrey Vo on Nov 02 Severity: moderate Affected versions: - Apache Arrow Rust 60.0.0 before 60.1.0 - Apache Arrow Rust 59.0.0 through 59.3.1 - Apache Arrow…
Week in review: Binance hit by $6.3 billion theft, impact of Brotli vulnerability
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: r/opensource bans AI projects, and solo devs go down with them…
CVE-2026-120135: Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by default
Posted by Jens Geyer on Oct 30 Severity: important CVSS 4.0: 8.2 (high) CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Affected versions: - Apache…