What is GHSA-9664-6254-g54f?

GHSA-9664-6254-g54f is a security advisory published by GitHub Security Advisories with High severity. Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Syncope. An...

Which CVE IDs does GHSA-9664-6254-g54f cover?

GHSA-9664-6254-g54f covers the following CVE IDs: CVE-2026-73178. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9664-6254-g54f?

GHSA-9664-6254-g54f has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-9664-6254-g54fHighCVSS 7.5

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Syncope. An...

Vendor

GitHub Security Advisories

Published

September 14, 2026

Last Modified

September 14, 2026

🔗 CVE IDs covered (1)

CVE-2026-73178 →

📋 Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Syncope.

An administrator with adequate entitlements can get access via REST to the list of existing Access Tokens, including their signed JWT body. These values can be then used to perform further REST requests, impersonating users with higher administration entitlements.

This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2.

Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-73178
https://lists.apache.org/thread/owcdm0stb39mnkpyps0h6yw4gp2olnkj
http://www.openwall.com/lists/oss-security/2026/09/14/4
https://github.com/advisories/GHSA-9664-6254-g54f