CVE-2026-62183

CVE-2026-62183 — Apache Syncope user self-service privilege escalation Improper Privilege Management CWE-269 in Apache Syncope. An authenticated, low-privilege user can grant themselves arbitrary roles and group memberships, external resources, and a new realm through the user self-service API —...

Sensitive Data Leak

Apache Syncope is vulnerable to a sensitive data leak. The vulnerability is due to improper handling of AES keys with non‑standard lengths, where the padded key value is logged and attackers can read the logs to obtain the secret key...

Privilege Escalation

Apache Syncope is vulnerable to privilege escalation. The vulnerability is due to the disclosure of the JWKS configuration for internal JWT authentication, where an attacker can obtain admin privileges after completing a successful authentication and acquiring a valid low‑privilege JWT...

Authentication Bypass

Apache Syncope is vulnerable to authentication bypass. The vulnerability is due to the disclosure of the configured JWKS settings for internal JWT authentication, where an attacker can spoof another user's privileges after completing a successful authentication and obtaining a valid JWT...

Arbitrary Code Execution

Apache Syncope is vulnerable to an Arbitrary Code Execution. The vulnerability is due to imported BPMN processes allowing unsandboxed Groovy scriptTask execution, which allows an attacker with sufficient administrative entitlements to import and start a malicious BPMN process through the REST API...

Server-Side Request Forgery (SSRF)

org.apache.syncope.core.idm, syncope-core-idm-logic is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of user-controlled requests, which allows an authenticated low-privileged attacker to make the server send requests to arbitrary internal or...

Remote Code Execution (RCE)

Apache Syncope is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper isolation of the connector subsystem, where scripted connectors REST and SQL can execute Groovy scripts and an attacker with sufficient privileges can trigger this capability to achieve remote code...

Improper Privilege Management

Apache Syncope is vulnerable to Improper Privilege Management. The vulnerability is due to insufficient authorization checks in certain user workflow configurations, which allows an authenticated user to grant themselves defined Roles through a REST API and gain their associated entitlements,...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.1.0-m0, <=4.1.2), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.1.0-m0, <=4.1.2) +33 more potentially affected by CVE-2026-78330 via org.apache.syncope.core:syncope-core-spring (>=4.1.0-m0, <=4.1.2)

org.apache.syncope.core:syncope-core-spring MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.2 and more Source cves: CVE-2026-78330https://vu...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.1.0-m0, <=4.1.2), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.1.0-m0, <=4.1.2) +36 more potentially affected by CVE-2026-77883 via org.apache.syncope.core:syncope-core-provisioning-api (>=4.1.0-m0, <=4.1.2)

org.apache.syncope.core:syncope-core-provisioning-api MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.2 and more Source cves:...

org.apache.syncope.core.am:syncope-core-am-logic (>=3.0.0-m0, <=4.0.7), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=3.0.0-m0, <=4.0.7) +43 more potentially affected by CVE-2026-77883 via org.apache.syncope.core:syncope-core-provisioning-api (>=3.0.0-m0, <=4.0.7)

org.apache.syncope.core:syncope-core-provisioning-api MAVEN version =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.2, =4.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.7 and more Source cves: CVE-2026-77883https://vul...

org.apache.syncope.client.am:syncope-client-am-console (>=4.1.0-m0, <=4.1.2), org.apache.syncope.client.am:syncope-client-am-enduser (>=4.1.0-m0, <=4.1.2) +12 more potentially affected by CVE-2026-78318 via org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui (>=4.1.0-m0, <=4.1.2)

org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.2 - org.apache.syncope.ext.s...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.1.0-m0, <=4.1.2), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.1.0-m0, <=4.1.2) +13 more potentially affected by CVE-2026-75030 via org.apache.syncope.core.idrepo:syncope-core-idrepo-logic (>=4.1.0-m0, <=4.1.2)

org.apache.syncope.core.idrepo:syncope-core-idrepo-logic MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.2 So...

org.apache.syncope.core.idm:syncope-core-idm-rest-cxf (>=4.1.0-m0, <=4.1.2), org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=4.1.0-m0, <=4.1.2) +3 more potentially affected by CVE-2026-73668 via org.apache.syncope.core.idm:syncope-core-idm-logic (>=4.1.0-m0, <=4.1.2)

org.apache.syncope.core.idm:syncope-core-idm-logic MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.2 Source cves: CVE-2026-73668 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPECOREIDM-20186777...

org.apache.syncope.core:syncope-core-metrics-starter (>=4.1.0-m0, <=4.1.2), org.apache.syncope.core:syncope-core-self-keymaster-starter (>=4.1.0-m0, <=4.1.2) +3 more potentially affected by CVE-2026-77051 via org.apache.syncope.core:syncope-core-persistence-jpa (>=4.1.0-m0, <=4.1.2)

org.apache.syncope.core:syncope-core-persistence-jpa MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.2 Source cves: CVE-2026-77051 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPECORE-20186778...

org.apache.syncope.core.idm:syncope-core-idm-rest-cxf (>=3.0.0-m0, <=4.0.7), org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=3.0.0-m0, <=4.0.7) +3 more potentially affected by CVE-2026-73668 via org.apache.syncope.core.idm:syncope-core-idm-logic (>=3.0.0-m0, <=4.0.7)

org.apache.syncope.core.idm:syncope-core-idm-logic MAVEN version =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.7 Source cves: CVE-2026-73668 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPECOREIDM-20186777...

org.apache.syncope.core.am:syncope-core-am-logic (>=3.0.0-m0, <=4.0.7), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=3.0.0-m0, <=4.0.7) +20 more potentially affected by CVE-2026-75015 via org.apache.syncope.core:syncope-core-provisioning-java (>=3.0.0-m0, <=4.0.7)

org.apache.syncope.core:syncope-core-provisioning-java MAVEN version =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.2, =3.0.0-m0, =3.0.0-m0, =3.0.0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.7 -...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.1.0-m0, <=4.1.2), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.1.0-m0, <=4.1.2) +18 more potentially affected by CVE-2026-75015 via org.apache.syncope.core:syncope-core-provisioning-java (>=4.1.0-m0, <=4.1.2)

org.apache.syncope.core:syncope-core-provisioning-java MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.2 -...

org.apache.syncope.core:syncope-core-metrics-starter (>=4.0.2, <=4.0.7), org.apache.syncope.core:syncope-core-persistence-jpa (>=4.0.0-m0, <=4.0.7) +13 more potentially affected by CVE-2026-73579 via org.apache.syncope.core:syncope-core-persistence-common (>=4.0.0-m0, <=4.0.7)

org.apache.syncope.core:syncope-core-persistence-common MAVEN version =4.0.0-m0, =4.0.2, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.1.0-m0, <=4.1.2), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.1.0-m0, <=4.1.2) +33 more potentially affected by CVE-2026-77147 via org.apache.syncope.core:syncope-core-spring (>=4.1.0-m0, <=4.1.2)

org.apache.syncope.core:syncope-core-spring MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.2 and more Source cves: CVE-2026-77147https://vu...