Privilege Escalation in Apache Syncope Self-Service Workflows

This repository is a small, focused exploit reference for CVE-2026-62183 in Apache Syncope. It contains one executable PoC shell script (poc.sh) plus documentation in README.md and BUILD.md. The exploit is not part of a larger framework. Main capability: the PoC demonstrates authenticated privilege escalation through Apache Syncope's self-service REST API. A low-privilege user can call PATCH /users/self/{key} and add privileged fields—specifically roles—to their own account because the self-service logic checks only that the caller is authenticated, while the deeper authorization checks are skipped for self operations. The included exploit self-assigns the existing 'User manager' role and then proves the escalation by successfully reading another user's account. Repository structure: - poc.sh: operational shell PoC using curl and python for JSON parsing. - README.md: detailed vulnerability analysis, affected versions, root cause, exploitation conditions, and references. - BUILD.md: step-by-step instructions to reproduce the issue locally using the Apache Syncope standalone distribution and JDK 17. - .gitattributes: line-ending metadata only. Exploit flow in poc.sh: 1. Uses admin credentials to create a normal user via POST /users. 2. Verifies the new user cannot read another account (GET /users/bellini returns 403). 3. Sends PATCH /users/self/{key} as that low-privilege user with a JSON body adding role 'User manager'. 4. Repeats GET /users/bellini and expects 200, confirming privilege escalation. The exploit is operational but basic: it uses hardcoded credentials, a hardcoded role name, and a local default target URL. It is intended as a runtime-confirmed proof of concept rather than a generalized exploitation framework or mass scanner.