Apache Software Foundation Apache Syncope
18 CVEs affecting Apache Software Foundation Apache Syncope. Latest disclosed: 2026-07-20. Critical: 5, High: 6.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-63071 | Critical | 9.8 | 2026-07-20 | Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malic… |
CVE-2026-62183 | Critical | 9.8 | 2026-07-20 | Improper Privilege Management vulnerability in Apache Syncope. When: * the all-Java user workflow adapter is configured, or * the Flowable user workflow adap… |
CVE-2026-57308 | Critical | 9.8 | 2026-07-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator with adequate entitleme… |
CVE-2026-53421 | Critical | 9.8 | 2026-07-20 | Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve remote code execution th… |
CVE-2026-53405 | Critical | 9.8 | 2026-07-20 | Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process defi… |
CVE-2026-62418 | High | 8.1 | 2026-07-20 | Low-privileged authenticated Server-Side Request Forgery (SSRF) vulnerability in Apache Syncope via Connectors and Resources check. This issue affects Apac… |
CVE-2025-65998 | High | 7.5 | 2025-11-24 | Apache Syncope can be configured to store the user password values in the internal database with AES encryption, though this is not the default option. When A… |
CVE-2026-42782 | High | 7.2 | 2026-05-25 | Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malic… |
CVE-2025-57738 | High | 7.2 | 2025-10-20 | Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide custom implementations of a few Java inter… |
CVE-2018-17186 | High | 7.2 | 2018-11-06 | An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, file write, and cod… |
CVE-2018-1321 | High | 7.2 | 2018-03-20 | An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x whic… |
CVE-2026-23794 | Medium | 6.8 | 2026-02-03 | Reflected XSS in Apache Syncope's Enduser Login page. An attacker that tricks a legitimate user into clicking a malicious link and logging in to Syncope Enduse… |
CVE-2024-45031 | Medium | 6.1 | 2024-10-24 | When editing objects in the Syncope Console, incomplete HTML tags could be used to bypass HTML sanitization. This made it possible to inject stored XSS payload… |
CVE-2024-38503 | Medium | 5.4 | 2024-07-22 | When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. The same vuln… |
CVE-2018-17184 | Medium | 5.4 | 2018-11-06 | A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector names, Report names, Any… |
CVE-2026-42797 | Medium | 4.9 | 2026-05-25 | Exposure of Sensitive Information Through Data Queries vulnerability in Apache Syncope. An administrator with adequate entitlements for Derived Schemas can cr… |
CVE-2026-23795 | Medium | 4.9 | 2026-02-03 | Improper Restriction of XML External Entity Reference vulnerability in Apache Syncope Console. An administrator with adequate entitlements to create or edit Ke… |
CVE-2018-1322 | Medium | 4.9 | 2018-03-20 | An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be… |