Threat Intelligence Database

Apache Syncope contains an improper encoding or escaping of output vulnerability (CVE-2026-73195) that allows authenticated users to store spreadsheet formula payloads in their own plain attributes. When these users are included in a CSV export, opening the CSV file in a spreadsheet application may execute the formula. This affects versions from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Upgrading to versions 4.0.8 or 4.1.3 mitigates the issue.

Apache Syncope versions from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an Open Redirect vulnerability when configured for CAS authentication. The vulnerability arises because the target Apereo CAS instance URL is determined by untrusted client-supplied forwarded HTTP headers. This can lead to URL redirection to untrusted sites. Fixed versions 4.0.8 and 4.1.3 address this issue.

Apache Syncope versions 4.0.4 through 4.0.7 and 4.1.0-M0 through 4.1.2 contain a cross-site scripting (XSS) vulnerability. This issue arises from improper neutralization of input during web page generation, allowing malicious HTML and JavaScript to be injected via notification messages on Console's and Enduser's login pages. The vulnerability is fixed in versions 4.0.8 and 4.1.3.

Apache Syncope contains a code injection vulnerability (CVE-2026-77147) that allows an administrator with sufficient privileges to create a malicious Groovy Command class, bypassing the Groovy security sandbox. This affects versions from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Upgrading to versions 4.0.8 or 4.1.3 mitigates this issue.

A vulnerability in Apache Syncope allows an administrator with entitlements for Derived Schemas to create a malicious JEXL expression. This can enable any administrator with User read entitlements to access sensitive information from LinkedAccount or Manager objects, potentially including hashed credentials. The issue affects versions from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Upgrading to versions 4.0.8 or 4.1.3 addresses this vulnerability.

A vulnerability in Apache Syncope allows any authenticated user to retrieve the list of configured OpenID Connect (OIDC) providers for Single Sign-On (SSO). The response includes all configuration details, including client secrets, regardless of the user's entitlements. This affects Apache Syncope versions from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Upgrading to versions 4.0.8 or 4.1.3 mitigates this issue.

Apache Syncope contains an incorrect privilege assignment vulnerability that allows an attacker to gain admin privileges after successful authentication with a low-privilege JWT if the JWKS settings are disclosed. This affects versions from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Upgrading to versions 4.0.8 or 4.1.3 mitigates this issue.

Apache Syncope contains a missing authorization vulnerability (CVE-2026-75030) that allows an administrator with task execution entitlements to mass (de)provision group members without proper group-related administration rights. This affects versions from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Upgrading to versions 4.0.8 or 4.1.3 mitigates this issue.

Apache Syncope versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain a vulnerability that allows an administrator with sufficient entitlements to access the list of existing Access Tokens via REST, including their signed JWT bodies. These tokens can be used to perform further REST requests and impersonate users with higher administrative privileges. Upgrading to versions 4.0.8 or 4.1.3 mitigates this issue.

An Improper Privilege Management vulnerability exists in Apache Syncope allowing delegations to be created or updated with roles not owned by the delegating user or outside the allowed realm subtree. This affects Apache Syncope versions from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Upgrading to versions 4.0.8 or 4.1.3 addresses this issue.