Apache Syncope
18 CVEs affecting Apache Syncope. Latest disclosed: 2026-05-25. Critical: 2, High: 6.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-1961 | Critical | 9.8 | 2020-05-04 | Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to 2.1.6, enabling at… |
CVE-2020-1959 | Critical | 9.8 | 2020-05-04 | A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary Java EL expressions, leading to an unau… |
CVE-2025-65998 | High | 7.5 | 2025-11-24 | Apache Syncope can be configured to store the user password values in the internal database with AES encryption, though this is not the default option. When A… |
CVE-2026-42782 | High | 7.2 | 2026-05-25 | Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malic… |
CVE-2025-57738 | High | 7.2 | 2025-10-20 | Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide custom implementations of a few Java inter… |
CVE-2020-11977 | High | 7.2 | 2020-09-15 | In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow entitlements can use Shell Service Task… |
CVE-2018-17186 | High | 7.2 | 2018-11-06 | An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, file write, and cod… |
CVE-2018-1321 | High | 7.2 | 2018-03-20 | An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x whic… |
CVE-2026-23794 | Medium | 6.8 | 2026-02-03 | Reflected XSS in Apache Syncope's Enduser Login page. An attacker that tricks a legitimate user into clicking a malicious link and logging in to Syncope Enduse… |
CVE-2024-45031 | Medium | 6.1 | 2024-10-24 | When editing objects in the Syncope Console, incomplete HTML tags could be used to bypass HTML sanitization. This made it possible to inject stored XSS payload… |
CVE-2024-38503 | Medium | 5.4 | 2024-07-22 | When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. The same vuln… |
CVE-2019-17557 | Medium | 5.4 | 2020-05-04 | It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the… |
CVE-2018-17184 | Medium | 5.4 | 2018-11-06 | A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector names, Report names, Any… |
CVE-2026-42797 | Medium | 4.9 | 2026-05-25 | Exposure of Sensitive Information Through Data Queries vulnerability in Apache Syncope. An administrator with adequate entitlements for Derived Schemas can cr… |
CVE-2026-23795 | Medium | 4.9 | 2026-02-03 | Improper Restriction of XML External Entity Reference vulnerability in Apache Syncope Console. An administrator with adequate entitlements to create or edit Ke… |
CVE-2018-1322 | Medium | 4.9 | 2018-03-20 | An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be… |
CVE-2014-3503 | | 2014-07-11 | Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute f… | |
CVE-2014-0111 | | 2014-04-17 | Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons JEXL… |