Vulnerability in Apache Software Foundation Syncope
CVE-2026-75015
Insufficiently Protected Credentials vulnerability in Apache Syncope. Audit events, when sent to the configured store, are not sufficiently masked for the sensitive values they might carry on their payloads, thus allowing administrators to access such sensitive values. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
CVSS v3 metric
CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N.
Affected products
Weakness classification (CWE)
References
- security@apache.org (vendor-advisory)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2026-75015?
- CVE-2026-75015 is a medium-severity vulnerability in Apache Software Foundation Syncope, classified under Insufficiently Protected Credentials. CVSS score: 4.9/10. Published 2026-09-14.
- How severe is CVE-2026-75015?
- Medium severity. CVSS v3 base score is 4.9 out of 10.