CVE-2026-78330

Incorrect privilege assignment vulnerability in Apache Syncope. Internal JWT authentication resolves the AccessToken record associated with a JWT purely by its JWT ID (JTI), without ever checking that the AccessToken's recorded owner matches the JWT's own subject claim, in both AuthDataAccessor.authenticate(JWTAuthentication) (admin path) and SyncopeJWTSSOProvider.resolve(JWTClaimsSet) (non-admin/delegated path). An attacker who already holds a valid, currently-issued low-privilege JWT/access-token pair and who also knows the internal JWKS signing configuration (protocol and key) can forge a new JWT that reuses that same JTI but carries a different subject (e.g. an administrator's username), obtaining that user's privileges -- including full admin access -- without the server detecting the mismatch. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.