CVE-2026-77147 Apache Syncope: Groovy Sandbox escape for empty CommandArgs

Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy Command class containing untrusted code in their CommandArgs static implementation, bypassing the Groovy security...

CVE-2026-77147

Apache Syncope is vulnerable to an Improper Control of Generation of Code (Code Injection) vulnerability. An administrator with adequate entitlements for Implementations can create a malicious Groovy Command class containing untrusted code in their CommandArgs static implementation , effectively ...

EUVD-2026-77444

Incorrect Authorization vulnerability in Apache Syncope. An administrator with ClientApp's update entitlement is unable to perform the related operation, while ClientApp's create entitlement is checked both for create and update operations on ClientApp. This issue affects Apache Syncope: from...

CVE-2026-77181

An Incorrect Authorization vulnerability exists in Apache Syncope where administrators with ClientApp update entitlement are unable to perform related operations because the system incorrectly checks for create entitlement during both create and update operations. This issue affects versions 3.0....

CVE-2026-77181 Apache Syncope: ClientApp update entitlement not effective

Incorrect Authorization vulnerability in Apache Syncope. An administrator with ClientApp's update entitlement is unable to perform the related operation, while ClientApp's create entitlement is checked both for create and update operations on ClientApp. This issue affects Apache Syncope: from...

CVE-2026-77181 Apache Syncope: ClientApp update entitlement not effective

Incorrect Authorization vulnerability in Apache Syncope. An administrator with ClientApp's update entitlement is unable to perform the related operation, while ClientApp's create entitlement is checked both for create and update operations on ClientApp. This issue affects Apache Syncope: from...

CVE-2026-77883 Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist

Exposure of sensitive information through data queries vulnerability in Apache Syncope. An administrator with adequate entitlements for Derived Schemas can create a malicious JEXL expression which allows any administrator with sufficient entitlements for User read to access LinkedAccount's if...

EUVD-2026-77441

Exposure of sensitive information through data queries vulnerability in Apache Syncope. An administrator with adequate entitlements for Derived Schemas can create a malicious JEXL expression which allows any administrator with sufficient entitlements for User read to access LinkedAccount's if...

CVE-2026-77883 Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist

Exposure of sensitive information through data queries vulnerability in Apache Syncope. An administrator with adequate entitlements for Derived Schemas can create a malicious JEXL expression which allows any administrator with sufficient entitlements for User read to access LinkedAccount's if...

CVE-2026-77883

Apache Syncope versions 3.0.0-M0 through 3.0.16 , 4.0.0-M0 through 4.0.7 , and 4.1.0-M0 through 4.1.2 are vulnerable to an information disclosure flaw. An administrator with entitlements for Derived Schemas can create a malicious JEXL expression that enables any administrator with User read entit...

EUVD-2026-77439

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Syncope. The notification message, as optionally shown by Console's and Enduser's login pages can be instructed to display HTML tags with unsafe JS inline, via malicious HTTP link generation...

CVE-2026-78318 Apache Syncope: Unauthenticated reflected XSS in Console and Enduser

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Syncope. The notification message, as optionally shown by Console's and Enduser's login pages can be instructed to display HTML tags with unsafe JS inline, via malicious HTTP link generation...

CVE-2026-78318

Apache Syncope versions 4.0.4 through 4.0.7 and 4.1.0-M0 through 4.1.2 are vulnerable to a cross-site scripting (XSS) flaw due to improper neutralization of input during web page generation. An attacker can instruct the notification message —optionally displayed on Console and Enduser login pages...

CVE-2026-78318 Apache Syncope: Unauthenticated reflected XSS in Console and Enduser

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Syncope. The notification message, as optionally shown by Console's and Enduser's login pages can be instructed to display HTML tags with unsafe JS inline, via malicious HTTP link generation...

EUVD-2026-77438

Incorrect privilege assignment vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed at least protocol and key, an attacker can obtain admin privileges after completing a successful authentication and obtaining a valid low-privileges JWT...

CVE-2026-78330 Apache Syncope: Privilege escalation for admin user via JWT authentication

Incorrect privilege assignment vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed at least protocol and key, an attacker can obtain admin privileges after completing a successful authentication and obtaining a valid low-privileges JWT...

CVE-2026-78330

The Apache Syncope identity management solution is vulnerable to an incorrect privilege assignment flaw. If an attacker discovers the configured JWKS settings (specifically the protocol and key) for internal JWT authentication, they can escalate their privileges to admin after successfully authen...

CVE-2026-78330 Apache Syncope: Privilege escalation for admin user via JWT authentication

Incorrect privilege assignment vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed at least protocol and key, an attacker can obtain admin privileges after completing a successful authentication and obtaining a valid low-privileges JWT...

EUVD-2026-77437

Insertion of sensitive information into sent data vulnerability in Apache Syncope. Any authenticated user can query for the list of available OIDC providers configured for SSO with Console and Enduser. The returned payload contains all configuration settings, including client secrets, regardless ...

CVE-2026-78336 Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user

Insertion of sensitive information into sent data vulnerability in Apache Syncope. Any authenticated user can query for the list of available OIDC providers configured for SSO with Console and Enduser. The returned payload contains all configuration settings, including client secrets, regardless ...