CVE-2026-73470

Improper Privilege Management vulnerability in Apache Syncope. DelegationDataBinderImpl.update() attaches any Role resolvable via RoleDAO to a Delegation without checking that the Role belongs to the delegating User or that the Role's Realm falls within the Realm subtree for which the caller's Delegation-management entitlement was granted, so Delegations can be created or updated with Roles not owned by the delegating User or outside the granted Realm subtree. DelegationLogic.securityChecks() independently treats mere presence of a Delegation-management entitlement key as authorization, even when that entitlement's associated Realm set is empty. The Delegation feature (SYNCOPE-129) shipped with these gaps from its first release: published under org.apache.syncope.core:syncope-core-logic in the 2.1.x line (2.1.10-2.1.14), then under org.apache.syncope.core:syncope-core-provisioning-java and org.apache.syncope.core.idrepo:syncope-core-idrepo-logic from 3.0.0-M0 through 4.0.7 and 4.1.0-M0...