AS
Product
Apache Syncope
30
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 17High 7Medium 6Low 0
Watch
Add Apache Syncope to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-73370 | 9.8 | Sep 14 | Apache Syncope: Cross-Realm boundaries reconciliation bypass Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.7; 4.1.0-M0 through 4.1.2 |
| CVE-2026-73470 | 9.8 | Sep 14 | Apache Syncope: Delegating users can grant unowned Roles Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.7; 4.1.0-M0 through 4.1.2 |
| CVE-2026-73579 | 9.8 | Sep 14 | Apache Syncope: Non-recursive Any search could skip Realms restrictions Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.7; 4.1.0-M0 through 4.1.2 |
| CVE-2026-75030 | 9.8 | Sep 14 | Apache Syncope: Incomplete authorization checks for Group members deprovisioning Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.7; 4.1.0-M0 through 4.1.2 |
| CVE-2026-77051 | 9.8 | Sep 14 | Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.7; 4.1.0-M0 through 4.1.2 |
| CVE-2026-73668 | 9.8 | Sep 14 | Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.7; 4.1.0-M0 through 4.1.2 |
| CVE-2026-77181 | 9.8 | Sep 14 | Apache Syncope: ClientApp update entitlement not effective Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.7; 4.1.0-M0 through 4.1.2 |
| CVE-2026-78330 | 9.8 | Sep 14 | Apache Syncope: Privilege escalation for admin user via JWT authentication Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.7; 4.1.0-M0 through 4.1.2 |
| CVE-2026-82232 | 9.8 | Sep 14 | Apache Syncope: SQL injection via sort parameter in Task search Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.7; 4.1.0-M0 through 4.1.2 |
| CVE-2026-86460 | 9.8 | Sep 14 | Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.7; 4.1.0-M0 through 4.1.2 |
| CVE-2026-62183 | 9.8 | Jul 20 | Apache Syncope: User self-service privilege escalation Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.6; 4.1.0-M0 through 4.1.1 |
| CVE-2026-57308 | 9.8 | Jul 20 | Apache Syncope: SQL injection vulnerability in Audit Events search Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.6; 4.1.0-M0 through 4.1.1 |
| CVE-2026-53421 | 9.8 | Jul 20 | Apache Syncope: Remote Code Execution via Scripted Connector Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.6; 4.1.0-M0 through 4.1.1 |
| CVE-2026-53405 | 9.8 | Jul 20 | Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.6; 4.1.0-M0 through 4.1.1 |
| CVE-2026-63071 | 9.8 | Jul 20 | Apache Syncope: RCE via Groovy Sandbox bypass Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.6; 4.1.0-M0 through 4.1.1 |
| CVE-2026-87785 | 9.1 | Sep 14 | Apache Syncope: JWT subject spoofing Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.7; 4.1.0-M0 through 4.1.2 |
| CVE-2026-87802 | 9.1 | Sep 14 | Apache Syncope: SRA OAuth2 JWT signature verification bypass Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.7; 4.1.0-M0 through 4.1.2 |
| CVE-2026-62418 | 8.1 | Jul 20 | Apache Syncope: Low-privileged authenticated SSRF in Connectors and Resources check Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.6; 4.1.0-M0 through 4.1.1 |
| CVE-2026-73236 | 7.5 | Sep 14 | Apache Syncope: Cross-Realm authorization bypass in delegated administration Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.7; 4.1.0-M0 through 4.1.2 |
| CVE-2026-73178 | 7.5 | Sep 14 | Apache Syncope: JWT Access Token takeover Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.7; 4.1.0-M0 through 4.1.2 |
| CVE-2026-78336 | 7.5 | Sep 14 | Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.7; 4.1.0-M0 through 4.1.2 |
| CVE-2026-87779 | 7.5 | Sep 14 | Apache Syncope: AES Secret Key disclosure via log output Affected: 3.0.15 through 3.0.16; 4.0.3 through 4.0.7; 4.1.0-M0 through 4.1.2 |
| CVE-2026-73195 | 7.3 | Sep 14 | Apache Syncope: CSV export spreadsheet formula injection Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.7; 4.1.0-M0 through 4.1.2 |
| CVE-2026-42782 | 7.2 | May 25 | Apache Syncope: Post-auth RCE via Groovy static Affected: 3.0 through 3.0.16; 4.0 through 4.0.5; 4.1 through 4.1.0 |
| CVE-2026-77147 | 6.5 | Sep 14 | Apache Syncope: Groovy Sandbox escape for empty CommandArgs Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.7; 4.1.0-M0 through 4.1.2 |
| CVE-2026-73191 | 6.1 | Sep 14 | Apache Syncope: CAS service URL injection via Forwarded HTTP headers Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.7; 4.1.0-M0 through 4.1.2 |
| CVE-2026-78318 | 6.1 | Sep 14 | Apache Syncope: Unauthenticated reflected XSS in Console and Enduser Affected: 4.0.4 through 4.0.7; 4.1.0-M0 through 4.1.2 |
| CVE-2026-75015 | 4.9 | Sep 14 | Apache Syncope: Nested secrets leak cleartext into audit records readable Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.7; 4.1.0-M0 through 4.1.2 |
| CVE-2026-77883 | 4.9 | Sep 14 | Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist Affected: 3.0.0-M0 through 3.0.16; 4.0.0-M0 through 4.0.7; 4.1.0-M0 through 4.1.2 |
| CVE-2026-42797 | 4.9 | May 25 | Apache Syncope: JexlContextBuilder Information Disclosure Affected: 3.0 through 3.0.16; 4.0 through 4.0.5; 4.1 through 4.1.0 |
Showing 30