Improper Isolation or Compartmentalization

Overview org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn is an Open Source system for managing digital identities in enterprise environments, Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization through...

org.apache.syncope.core:syncope-core-metrics-starter (>=4.1.0-m0, <=4.1.1), org.apache.syncope.core:syncope-core-self-keymaster-starter (>=4.1.0-m0, <=4.1.1) +3 more potentially affected by CVE-2026-57308 via org.apache.syncope.core:syncope-core-persistence-jpa (>=4.1.0-m0, <=4.1.1)

org.apache.syncope.core:syncope-core-persistence-jpa MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.1 Source cves: CVE-2026-57308 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPECORE-19352541...

org.apache.syncope.core:syncope-core-metrics-starter (>=4.0.2, <=4.0.6), org.apache.syncope.core:syncope-core-persistence-jpa-json (>=3.0.0-m0, <=3.0.16) +7 more potentially affected by CVE-2026-57308 via org.apache.syncope.core:syncope-core-persistence-jpa (>=3.0.0-m0, <=4.0.6)

org.apache.syncope.core:syncope-core-persistence-jpa MAVEN version =3.0.0-m0, =4.0.2, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.6, =3.0.0-m0, =4.0.6 Source cves: CVE-2026-57308 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPECORE-19352541...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection through the audit event search ORDER BY handling in JPAAuditEventDAO and Neo4jAuditEventDAO. An administrator with the right entitlements can execute arbitrary SQL by supplying crafted sort parameters in an audit-events...

SQL Injection

Overview org.apache.syncope.core:syncope-core-persistence-jpa is an Open Source system for managing digital identities in enterprise environments, implemented in Java EE technology and released under Apache 2.0 license. Affected versions of this package are vulnerable to SQL Injection through the...

org.apache.syncope.core:syncope-core-metrics-starter (>=4.1.0-m0, <=4.1.1), org.apache.syncope.core:syncope-core-self-keymaster-starter (>=4.1.0-m0, <=4.1.1) +4 more potentially affected by CVE-2026-62183 via org.apache.syncope.core:syncope-core-workflow-java (>=4.1.0-m0, <=4.1.1)

org.apache.syncope.core:syncope-core-workflow-java MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.1 Source cves: CVE-2026-62183 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPECORE-19352550...

org.apache.syncope.core:syncope-core-metrics-starter (>=4.0.2, <=4.0.6), org.apache.syncope.core:syncope-core-self-keymaster-starter (>=3.0.0-m0, <=4.0.6) +4 more potentially affected by CVE-2026-62183 via org.apache.syncope.core:syncope-core-workflow-java (>=3.0.0-m0, <=4.0.6)

org.apache.syncope.core:syncope-core-workflow-java MAVEN version =3.0.0-m0, =4.0.2, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.6 Source cves: CVE-2026-62183 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPECORE-19352550...

Incorrect Privilege Assignment

Overview Affected versions of this package are vulnerable to Incorrect Privilege Assignment through the user self-service workflow handling in UserSelfLogic, UserCR/UserUR, and DefaultUserWorkflowAdapter. An attacker can grant themselves defined roles and their entitlements by submitting a...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.1.0-m0, <=4.1.1), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.1.0-m0, <=4.1.1) +33 more potentially affected by CVE-2026-63071 via org.apache.syncope.core:syncope-core-spring (>=4.1.0-m0, <=4.1.1)

org.apache.syncope.core:syncope-core-spring MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.1 and more Source cves: CVE-2026-63071https://vu...

org.apache.syncope.core.am:syncope-core-am-logic (>=3.0.0-m0, <=4.0.6), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=3.0.0-m0, <=4.0.6) +39 more potentially affected by CVE-2026-63071 via org.apache.syncope.core:syncope-core-spring (>=3.0.0-m0, <=4.0.6)

org.apache.syncope.core:syncope-core-spring MAVEN version =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.2, =4.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.6 and more Source cves: CVE-2026-63071https://vulners.com/cve...

Improper Isolation or Compartmentalization

Overview Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization due to the GroovySandboxScriptEngineImpl implementation in the core/spring module. An administrator with the entitlements to manage Implementations can supply a malicious Groovy class that...

org.apache.syncope.core.idm:syncope-core-idm-rest-cxf (>=3.0.0-m0, <=4.0.6), org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=3.0.0-m0, <=4.0.6) +3 more potentially affected by CVE-2026-62418 via org.apache.syncope.core.idm:syncope-core-idm-logic (>=3.0.0-m0, <=4.0.6)

org.apache.syncope.core.idm:syncope-core-idm-logic MAVEN version =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.6 Source cves: CVE-2026-62418 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPECOREIDM-19352416...

org.apache.syncope.core.idm:syncope-core-idm-rest-cxf (>=4.1.0-m0, <=4.1.1), org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=4.1.0-m0, <=4.1.1) +3 more potentially affected by CVE-2026-62418 via org.apache.syncope.core.idm:syncope-core-idm-logic (>=4.1.0-m0, <=4.1.1)

org.apache.syncope.core.idm:syncope-core-idm-logic MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.1 Source cves: CVE-2026-62418 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPECOREIDM-19352416...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the ConnectorLogic.checkfinal ConnInstanceTO and ResourceLogic.checkfinal ResourceTO methods in the IDM logic layer. An authenticated low-privileged user can trigger the server to perform connector or...

CVE-2026-63071

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through...

CVE-2026-62418

Low-privileged authenticated Server-Side Request Forgery SSRF vulnerability in Apache Syncope via Connectors and Resources check. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version...

CVE-2026-57308

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort parameters. This issue affects Apache Syncope: fr...

CVE-2026-62183

Improper Privilege Management vulnerability in Apache Syncope. When: the all-Java user workflow adapter is configured, or the Flowable user workflow adapter is configured, bearing a BPMN definition not requiring admin approval for user self registration of self update requests the following...

CVE-2026-53421

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve remote code execution through the connector subsystem by relying on scripted connectors' REST and SQL capability to run Groovy scripts. This issue affects Apache...

CVE-2026-53405

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a Groovy scriptTask is imported and started, the Groovy...