What is CVE-2026-78318?

CVE-2026-78318 is a medium-severity vulnerability in Apache Software Foundation Syncope, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2026-09-14.

How severe is CVE-2026-78318?

Medium severity. CVSS v3 base score is 6.1 out of 10.

XSS in Apache Software Foundation Syncope

CVE-2026-78318

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Syncope. The notification message, as optionally shown by Console's and Enduser's login pages can be instructed to display HTML tags with unsafe JS inline, via malicious HTTP link generation. This issue affects Apache Syncope: from 4.0.4 through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

Vulnerability class: XSS (Cross-Site Scripting)

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Affected products

Apache Software Foundation Syncope

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

security@apache.org (vendor-advisory)
af854a3a-2127-422b-91ae-364da2661108

Frequently asked questions

What is CVE-2026-78318?: CVE-2026-78318 is a medium-severity vulnerability in Apache Software Foundation Syncope, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2026-09-14.
How severe is CVE-2026-78318?: Medium severity. CVSS v3 base score is 6.1 out of 10.