Apache Syncope (Apache Software Foundation) - vulnerabilities (CVEs)

40 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2026-09-14. Vendor: Apache Software Foundation.

CVEs of Apache Syncope

CVE-2026-73191 - CVSS 6.1 (medium), 2026-09-14: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Syncope. When the Syncope SRA is configured for CAS authentication, the target…
CVE-2026-73195 - CVSS 7.3 (high), 2026-09-14: Improper Encoding or Escaping of Output vulnerability in Apache Syncope. Authenticated users can store a spreadsheet formula payload in one of their own plain…
CVE-2026-73236 - CVSS 7.5 (high), 2026-09-14: Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks are based on Realm hierarchy and enforced via prefix…
CVE-2026-73370 - CVSS 9.8 (critical), 2026-09-14: Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks performed by Reconciliation service's pull and push, being…
CVE-2026-73178 - CVSS 7.5 (high), 2026-09-14: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Syncope. An administrator with adequate entitlements can get access via…
CVE-2026-73470 - CVSS 9.8 (critical), 2026-09-14: Improper Privilege Management vulnerability in Apache Syncope. Delegations can be created or updated with Roles not owned by the delegating User, or not for…
CVE-2026-73579 - CVSS 9.8 (critical), 2026-09-14: Incorrect Authorization vulnerability in Apache Syncope. Any search requests are transformed into SQL, Neo4J or Elasticsearch / Opensearch queries, depending…
CVE-2026-75015 - CVSS 4.9 (medium), 2026-09-14: Insufficiently Protected Credentials vulnerability in Apache Syncope. Audit events, when sent to the configured store, are not sufficiently masked for the…
CVE-2026-75030 - CVSS 9.8 (critical), 2026-09-14: Missing Authorization vulnerability in Apache Syncope. An administrator with task execution entitlements might be able to mass (de)provision group members,…
CVE-2026-77051 - CVSS 9.8 (critical), 2026-09-14: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator with adequate…
CVE-2026-73668 - CVSS 9.8 (critical), 2026-09-14: Incorrect Authorization vulnerability in Apache Syncope. An administrator with adequate entitlements in a given Realm may be able to read via REST the full…
CVE-2026-77147 - CVSS 6.5 (medium), 2026-09-14: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can…
CVE-2026-77181 - CVSS 9.8 (critical), 2026-09-14: Incorrect Authorization vulnerability in Apache Syncope. An administrator with ClientApp's update entitlement is unable to perform the related operation,…
CVE-2026-77883 - CVSS 4.9 (medium), 2026-09-14: Exposure of sensitive information through data queries vulnerability in Apache Syncope. An administrator with adequate entitlements for Derived Schemas can…
CVE-2026-78318 - CVSS 6.1 (medium), 2026-09-14: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Syncope. The notification message, as optionally…
CVE-2026-78330 - CVSS 9.8 (critical), 2026-09-14: Incorrect privilege assignment vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed (at least…
CVE-2026-78336 - CVSS 7.5 (high), 2026-09-14: Insertion of sensitive information into sent data vulnerability in Apache Syncope. Any authenticated user can query for the list of available OIDC providers…
CVE-2026-82232 - CVSS 9.8 (critical), 2026-09-14: Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope. An administrator with adequate…
CVE-2026-86460 - CVSS 9.8 (critical), 2026-09-14: Cypher injection vulnerability in the Neo4j persistence layer when processing some FIQL search conditions. This issue affects Apache Syncope: from 3.0.0-M0…
CVE-2026-87779 - CVSS 7.5 (high), 2026-09-14: Insertion of sensitive information into log file vulnerability in Apache Syncope. When AES key of non-standard length (not 16/24/32 bytes) is configured,…
CVE-2026-87785 - CVSS 9.1 (critical), 2026-09-14: Authentication bypass by spoofing vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed (at least…
CVE-2026-87802 - CVSS 9.1 (critical), 2026-09-14: Improper verification of cryptographic signature vulnerability in Apache Syncope. When SRA is configured for OAuth 2.0 without JWKS set URI assigned, an…
CVE-2026-62418 - CVSS 8.1 (high), 2026-07-20: Low-privileged authenticated Server-Side Request Forgery (SSRF) vulnerability in Apache Syncope via Connectors and Resources check. This issue affects Apache…
CVE-2026-62183 - CVSS 9.8 (critical), 2026-07-20: Improper Privilege Management vulnerability in Apache Syncope. When: * the all-Java user workflow adapter is configured, or * the Flowable user workflow…
CVE-2026-57308 - CVSS 9.8 (critical), 2026-07-20: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator with adequate…
CVE-2026-53421 - CVSS 9.8 (critical), 2026-07-20: Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve remote code execution…
CVE-2026-53405 - CVSS 9.8 (critical), 2026-07-20: Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process…
CVE-2026-63071 - CVSS 9.8 (critical), 2026-07-20: Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a…
CVE-2026-42797 - CVSS 4.9 (medium), 2026-05-25: Exposure of Sensitive Information Through Data Queries vulnerability in Apache Syncope. An administrator with adequate entitlements for Derived Schemas can…
CVE-2026-42782 - CVSS 7.2 (high), 2026-05-25: Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a…
CVE-2026-23795 - CVSS 4.9 (medium), 2026-02-03: Improper Restriction of XML External Entity Reference vulnerability in Apache Syncope Console. An administrator with adequate entitlements to create or edit…
CVE-2026-23794 - CVSS 6.8 (medium), 2026-02-03: Reflected XSS in Apache Syncope's Enduser Login page. An attacker that tricks a legitimate user into clicking a malicious link and logging in to Syncope…
CVE-2025-65998 - CVSS 7.5 (high), 2025-11-24: Apache Syncope can be configured to store the user password values in the internal database with AES encryption, though this is not the default option. When…
CVE-2025-57738 - CVSS 7.2 (high), 2025-10-20: Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide custom implementations of a few Java…
CVE-2024-45031 - CVSS 6.1 (medium), 2024-10-24: When editing objects in the Syncope Console, incomplete HTML tags could be used to bypass HTML sanitization. This made it possible to inject stored XSS…
CVE-2024-38503 - CVSS 5.4 (medium), 2024-07-22: When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. The same…
CVE-2018-17186 - CVSS 7.2 (high), 2018-11-06: An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, file write, and…
CVE-2018-17184 - CVSS 5.4 (medium), 2018-11-06: A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector names, Report names,…
CVE-2018-1322 - CVSS 4.9 (medium), 2018-03-20: An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may…
CVE-2018-1321 - CVSS 7.2 (high), 2018-03-20: An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x…