CVE-2026-78318 is a cross-site scripting vulnerability in Apache Syncope affecting versions 4.0.4 through 4.0.7 and 4.1.0-M0 through 4.1.2. The vulnerability occurs because notification messages optionally shown on Console's and Enduser's login pages do not properly neutralize input, allowing attackers to craft malicious HTTP links that inject unsafe HTML tags with inline JavaScript. This can lead to execution of arbitrary scripts in the context of the affected web application. The issue is resolved by upgrading to Apache Syncope versions 4.0.8 or 4.1.3.

Successful exploitation can lead to limited confidentiality and integrity impact by executing attacker-controlled scripts in the victim's browser when visiting a crafted link. This can result in theft of sensitive information or manipulation of the web page content. There is no impact on availability. The CVSS v3.1 base score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and low confidentiality and integrity impact.

Users should upgrade Apache Syncope to version 4.0.8 or 4.1.3, which include fixes for this vulnerability. No other mitigation or workaround is indicated. Patch status is confirmed by the vendor's advisory recommending these versions.