What is CVE-2026-23795?

CVE-2026-23795 is a medium-severity vulnerability in Apache Syncope, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 4.9/10. Published 2026-02-03.

How severe is CVE-2026-23795?

Medium severity. CVSS v3 base score is 4.9 out of 10.

XXE in Apache Syncope

CVE-2026-23795

Improper Restriction of XML External Entity Reference vulnerability in Apache Syncope Console. An administrator with adequate entitlements to create or edit Keymaster parameters via Console can construct malicious XML text to launch an XXE…

Vulnerability class: XXE (XML External Entity)

EPSS: 0.008 (53.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N.

Affected products

Apache Syncope
Apache Software Foundation Syncope — versions 3.0, 4.0

Weakness classification (CWE)

CWE-611 — Improper Restriction of XML External Entity Reference (XXE)

References

security@apache.org (vendor-advisory, Mailing List, Third Party Advisory)
af854a3a-2127-422b-91ae-364da2661108 (Mailing List, Third Party Advisory)

Frequently asked questions

What is CVE-2026-23795?: CVE-2026-23795 is a medium-severity vulnerability in Apache Syncope, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 4.9/10. Published 2026-02-03.
How severe is CVE-2026-23795?: Medium severity. CVSS v3 base score is 4.9 out of 10.