CVE-2026-113511
Authorization bypass through User-Controlled key vulnerability in Apache Syncope. A delegated administrator can relocate a Realm subtree
CVSS
—
No CVSS
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Nov 2, 2026 · Last modified: Nov 2, 2026 · CWE-639
Not enough EPSS history yet.
Authorization bypass through User-Controlled key vulnerability in Apache Syncope. A delegated administrator can relocate a Realm subtree across administrative realm boundaries without permission for the destination This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3. Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1091428.4 HIG—
———When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity (child_handle) that the caller put in the parent contact. Nothing checks that this child identity actually belongs to the CA making the request.5hCVE-2026-1091418.4 HIG—
———The vulnerability gives a role that is restricted to a list of CAs (cas = [...]) its full permission set for every request that is not tied to a CA, including the bulk import endpoint POST /api/v1/bulk/cas/import. It adds a new child CA under any existing CA, gives the child any of that CA's resources, and creates the ROAs given in the request5hCVE-2026-1204618.8 HIG—
———Jpom through 2.11.12 contains a cross-workspace authorization bypass in POST /node/ssh_command/batch that resolves command templates and SSH nodes by ID without workspace filtering. Authenticated users with SSH command execute permission in one workspace can supply foreign template and node IDs to run commands on other workspaces' SSH hosts using their stored credentials.6hCVE-2026-1204608.8 HIG—
———Jpom through 2.11.12 contains a cross-workspace authorization bypass vulnerability that allows authenticated users to manage other workspaces' Docker hosts by supplying foreign Docker asset ids. Attackers with Docker permission in any workspace can control containers, images, volumes and networks, including creating privileged containers with host bind mounts.7hCVE-2026-1204305.4 MED—
———Camaleon CMS before 2.9.2 contains an insecure direct object reference vulnerability in Admin::CategoriesController that allows authenticated users to modify unauthorized categories by referencing arbitrary category IDs. Users authorized for one post type can send update or destroy requests pairing another category ID with their authorized post_type_id to rename or delete categories.7hCVE-2026-1204274.3 MED—
———MrDoc through 1.1.1 contains a missing authorization vulnerability in the get_doctemp view that allows authenticated users to read other users' document templates. Attackers can enumerate the sequential doctemp_id POST parameter to retrieve the private template content of every user on the instance.7h