Advisories · Technology

Apache Software Foundation Apache Syncope.

Every CVE that names Apache Software Foundation Apache Syncope among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-114364 CVE record

Apache Syncope: SQL injection via unsanitized opEvent in Audit Events search
- Apache Software Foundation Apache Syncope
- SQL injection
Not analysed yet 2 Nov 2026
CVE-2026-113687 CVE record

Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypass
- Apache Software Foundation Apache Syncope
- CWE-653
Not analysed yet 2 Nov 2026
CVE-2026-113511 CVE record

Apache Syncope: Delegated administration boundaries can be bypassed for Realm update
- Apache Software Foundation Apache Syncope
- Broken access control
Not analysed yet 2 Nov 2026
CVE-2026-110535 CVE record

Apache Syncope: AuthProfile value escalation via self-service update
- Apache Software Foundation Apache Syncope
- Privilege escalation
Not analysed yet 2 Nov 2026
CVE-2026-109083 CVE record

Apache Syncope: Remote Code Execution via Flowable JUEL expression
- Apache Software Foundation Apache Syncope
- CWE-653
Not analysed yet 2 Nov 2026
CVE-2026-73191 CVE record

CVSS 6.1 Medium

Apache Syncope: CAS service URL injection via Forwarded HTTP headers
- Apache Software Foundation Apache Syncope
- Open redirect
Not analysed yet 14 Sept 2026
CVE-2026-73195 CVE record

CVSS 7.3 High

Apache Syncope: CSV export spreadsheet formula injection
- Apache Software Foundation Apache Syncope
- CWE-116
Not analysed yet 14 Sept 2026
CVE-2026-73236 CVE record

CVSS 7.5 High

Apache Syncope: Cross-Realm authorization bypass in delegated administration
- Apache Software Foundation Apache Syncope
- Broken access control
Not analysed yet 14 Sept 2026
CVE-2026-73370 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache Syncope: Cross-Realm boundaries reconciliation bypass
- Apache Software Foundation Apache Syncope
- Broken access control
Not analysed yet 14 Sept 2026
CVE-2026-73178 CVE record

CVSS 7.5 High

Apache Syncope: JWT Access Token takeover
- Apache Software Foundation Apache Syncope
- Information disclosure
Not analysed yet 14 Sept 2026
CVE-2026-73470 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache Syncope: Delegating users can grant unowned Roles
- Apache Software Foundation Apache Syncope
- Privilege escalation
Not analysed yet 14 Sept 2026
CVE-2026-73579 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache Syncope: Non-recursive Any search could skip Realms restrictions
- Apache Software Foundation Apache Syncope
- Broken access control
Not analysed yet 14 Sept 2026
CVE-2026-75015 CVE record

CVSS 4.9 Medium

Apache Syncope: Nested secrets leak cleartext into audit records readable
- Apache Software Foundation Apache Syncope
- Hard-coded credentials
Not analysed yet 14 Sept 2026
CVE-2026-75030 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache Syncope: Incomplete authorization checks for Group members deprovisioning
- Apache Software Foundation Apache Syncope
- Broken access control
Not analysed yet 14 Sept 2026
CVE-2026-77051 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search
- Apache Software Foundation Apache Syncope
- SQL injection
Not analysed yet 14 Sept 2026
CVE-2026-73668 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values
- Apache Software Foundation Apache Syncope
- Broken access control
Not analysed yet 14 Sept 2026
CVE-2026-77147 CVE record

CVSS 6.5 Medium

Apache Syncope: Groovy Sandbox escape for empty CommandArgs
- Apache Software Foundation Apache Syncope
- Code injection
Not analysed yet 14 Sept 2026
CVE-2026-77181 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache Syncope: ClientApp update entitlement not effective
- Apache Software Foundation Apache Syncope
- Broken access control
Not analysed yet 14 Sept 2026
CVE-2026-77883 CVE record

CVSS 4.9 Medium

Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist
- Apache Software Foundation Apache Syncope
- CWE-202
Not analysed yet 14 Sept 2026
CVE-2026-78318 CVE record

CVSS 6.1 Medium

Apache Syncope: Unauthenticated reflected XSS in Console and Enduser
- Apache Software Foundation Apache Syncope
- Cross-site scripting (XSS)
Not analysed yet 14 Sept 2026
CVE-2026-78330 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache Syncope: Privilege escalation for admin user via JWT authentication
- Apache Software Foundation Apache Syncope
- Privilege escalation
Not analysed yet 14 Sept 2026
CVE-2026-78336 CVE record

CVSS 7.5 High

Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user
- Apache Software Foundation Apache Syncope
- Information disclosure
Not analysed yet 14 Sept 2026
CVE-2026-82232 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache Syncope: SQL injection via sort parameter in Task search
- Apache Software Foundation Apache Syncope
- SQL injection
Not analysed yet 14 Sept 2026
CVE-2026-86460 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence
- Apache Software Foundation Apache Syncope
- SQL injection
Not analysed yet 14 Sept 2026
CVE-2026-87779 CVE record

CVSS 7.5 High

Apache Syncope: AES Secret Key disclosure via log output
- Apache Software Foundation Apache Syncope
- Information disclosure
Not analysed yet 14 Sept 2026
CVE-2026-87785 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache Syncope: JWT subject spoofing
- Apache Software Foundation Apache Syncope
- Authentication bypass
Not analysed yet 14 Sept 2026
CVE-2026-87802 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache Syncope: SRA OAuth2 JWT signature verification bypass
- Apache Software Foundation Apache Syncope
- Weak cryptography or TLS
Not analysed yet 14 Sept 2026
CVE-2026-62418 CVE record

CVSS 8.1 High

Apache Syncope: Low-privileged authenticated SSRF in Connectors and Resources check
- Apache Software Foundation Apache Syncope
- Server-side request forgery (SSRF)
Not analysed yet 20 Jul 2026
CVE-2026-62183 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache Syncope: User self-service privilege escalation
- Apache Software Foundation Apache Syncope
- Privilege escalation
Not analysed yet 20 Jul 2026
CVE-2026-57308 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache Syncope: SQL injection vulnerability in Audit Events search
- Apache Software Foundation Apache Syncope
- SQL injection
Not analysed yet 20 Jul 2026
CVE-2026-53421 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache Syncope: Remote Code Execution via Scripted Connector
- Apache Software Foundation Apache Syncope
- CWE-653
Not analysed yet 20 Jul 2026
CVE-2026-53405 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask
- Apache Software Foundation Apache Syncope
- CWE-653
Not analysed yet 20 Jul 2026
CVE-2026-63071 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache Syncope: RCE via Groovy Sandbox bypass
- Apache Software Foundation Apache Syncope
- CWE-653
Not analysed yet 20 Jul 2026