791 matches found
CVE-2026-62418
Low-privileged authenticated Server-Side Request Forgery SSRF vulnerability in Apache Syncope via Connectors and Resources check. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version...
EUVD-2026-45964
Low-privileged authenticated Server-Side Request Forgery SSRF vulnerability in Apache Syncope via Connectors and Resources check. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version...
org.apache.syncope.core.idm:syncope-core-idm-rest-cxf (>=4.0.0-m0, <=4.0.6), org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=4.0.0-m0, <=4.0.6) +3 more potentially affected by CVE-2026-62418 via org.apache.syncope.core.idm:syncope-core-idm-logic (>=4.0.0-m0, <=4.0.6)
org.apache.syncope.core.idm:syncope-core-idm-logic MAVEN version =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.6 Source cves: CVE-2026-62418 Source advisory: MEND:CVE-2026-62418...
CVE-2026-62418
Apache Syncope is vulnerable to a Server-Side Request Forgery (SSRF) flaw in the IDM logic layer, specifically within the ConnectorLogic.check(final ConnInstanceTO) and ResourceLogic.check(final ResourceTO) methods. The root cause is a failure to properly validate user inputs during connection an...
CVE-2026-62418 Apache Syncope: Low-privileged authenticated SSRF in Connectors and Resources check
Low-privileged authenticated Server-Side Request Forgery SSRF vulnerability in Apache Syncope via Connectors and Resources check. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version...
CVE-2026-62418 Apache Syncope: Low-privileged authenticated SSRF in Connectors and Resources check
Low-privileged authenticated Server-Side Request Forgery SSRF vulnerability in Apache Syncope via Connectors and Resources check. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version...
CVE-2026-62418 Apache Syncope: Low-privileged authenticated SSRF in Connectors and Resources check
Low-privileged authenticated Server-Side Request Forgery SSRF vulnerability in Apache Syncope via Connectors and Resources check. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version...
org.apache.syncope.core.idm:syncope-core-idm-rest-cxf (>=4.1.0-m0, <=4.1.1), org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=4.1.0-m0, <=4.1.1) +3 more potentially affected by CVE-2026-62418 via org.apache.syncope.core.idm:syncope-core-idm-logic (>=4.1.0-m0, <=4.1.1)
org.apache.syncope.core.idm:syncope-core-idm-logic MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.1 Source cves: CVE-2026-62418 Source advisory: MEND:CVE-2026-62418...
CVE-2026-62183 Apache Syncope: User self-service privilege escalation
Improper Privilege Management vulnerability in Apache Syncope. When: the all-Java user workflow adapter is configured, or the Flowable user workflow adapter is configured, bearing a BPMN definition not requiring admin approval for user self registration of self update requests the following...
EUVD-2026-45962
Improper Privilege Management vulnerability in Apache Syncope. When: the all-Java user workflow adapter is configured, or the Flowable user workflow adapter is configured, bearing a BPMN definition not requiring admin approval for user self registration of self update requests the following...
org.apache.syncope.core:syncope-core-metrics-starter (>=4.1.0-m0, <=4.1.1), org.apache.syncope.core:syncope-core-self-keymaster-starter (>=4.1.0-m0, <=4.1.1) +4 more potentially affected by CVE-2026-62183 via org.apache.syncope.core:syncope-core-workflow-java (>=4.1.0-m0, <=4.1.1)
org.apache.syncope.core:syncope-core-workflow-java MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.1 Source cves: CVE-2026-62183 Source advisory: MEND:CVE-2026-62183...
org.apache.syncope.core:syncope-core-metrics-starter (>=4.0.2, <=4.0.6), org.apache.syncope.core:syncope-core-self-keymaster-starter (>=4.0.0-m0, <=4.0.6) +4 more potentially affected by CVE-2026-62183 via org.apache.syncope.core:syncope-core-workflow-java (>=4.0.0-m0, <=4.0.6)
org.apache.syncope.core:syncope-core-workflow-java MAVEN version =4.0.0-m0, =4.0.2, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.6 Source cves: CVE-2026-62183 Source advisory: MEND:CVE-2026-62183...
CVE-2026-62183 Apache Syncope: User self-service privilege escalation
Improper Privilege Management vulnerability in Apache Syncope. When: the all-Java user workflow adapter is configured, or the Flowable user workflow adapter is configured, bearing a BPMN definition not requiring admin approval for user self registration of self update requests the following...
CVE-2026-62183 Apache Syncope: User self-service privilege escalation
Improper Privilege Management vulnerability in Apache Syncope. When: the all-Java user workflow adapter is configured, or the Flowable user workflow adapter is configured, bearing a BPMN definition not requiring admin approval for user self registration of self update requests the following...
CVE-2026-62183
Apache Syncope is vulnerable to an Improper Privilege Management (CWE-269) flaw in its user self-service workflow handling. Specifically, within the UserSelfLogic, UserCR/UserUR, and DefaultUserWorkflowAdapter components, the system fails to properly validate authorizations during self-registrati...
CVE-2026-62183
Improper Privilege Management vulnerability in Apache Syncope. When: the all-Java user workflow adapter is configured, or the Flowable user workflow adapter is configured, bearing a BPMN definition not requiring admin approval for user self registration of self update requests the following...
EUVD-2026-45959
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort parameters. This issue affects Apache Syncope: fr...
CVE-2026-57308
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort parameters. This issue affects Apache Syncope: fr...
CVE-2026-57308 Apache Syncope: SQL injection vulnerability in Audit Events search
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort parameters. This issue affects Apache Syncope: fr...
CVE-2026-57308 Apache Syncope: SQL injection vulnerability in Audit Events search
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort parameters. This issue affects Apache Syncope: fr...