Server-Side Request Forgery (SSRF)

org.apache.syncope.core.idm, syncope-core-idm-logic is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of user-controlled requests, which allows an authenticated low-privileged attacker to make the server send requests to arbitrary internal or...

org.apache.syncope.core.am:syncope-core-am-logic (>=3.0.0-m0, <=4.0.7), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=3.0.0-m0, <=4.0.7) +39 more potentially affected by CVE-2026-78330 via org.apache.syncope.core:syncope-core-spring (>=3.0.0-m0, <=4.0.7)

org.apache.syncope.core:syncope-core-spring MAVEN version =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.2, =4.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.7 and more Source cves: CVE-2026-78330https://vulners.com/cve...

org.apache.syncope.core.am:syncope-core-am-logic (>=3.0.0-m0, <=4.0.7), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=3.0.0-m0, <=4.0.7) +15 more potentially affected by CVE-2026-75030 via org.apache.syncope.core.idrepo:syncope-core-idrepo-logic (>=3.0.0-m0, <=4.0.7)

org.apache.syncope.core.idrepo:syncope-core-idrepo-logic MAVEN version =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.2, =3.0.0-m0, =3.0.0-m0, =3.0.0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.6, =3.0.0-m0, =4.0.7...

org.apache.syncope.core.idm:syncope-core-idm-rest-cxf (>=3.0.0-m0, <=4.0.7), org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=3.0.0-m0, <=4.0.7) +3 more potentially affected by CVE-2026-73668 via org.apache.syncope.core.idm:syncope-core-idm-logic (>=3.0.0-m0, <=4.0.7)

org.apache.syncope.core.idm:syncope-core-idm-logic MAVEN version =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.7 Source cves: CVE-2026-73668 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPECOREIDM-20186777...

org.apache.syncope.core.idm:syncope-core-idm-rest-cxf (>=4.1.0-m0, <=4.1.2), org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=4.1.0-m0, <=4.1.2) +3 more potentially affected by CVE-2026-73668 via org.apache.syncope.core.idm:syncope-core-idm-logic (>=4.1.0-m0, <=4.1.2)

org.apache.syncope.core.idm:syncope-core-idm-logic MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.2 Source cves: CVE-2026-73668 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPECOREIDM-20186777...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the REST API. An attacker can access confidential configuration values from other realms by leveraging administrative entitlements in one realm to read connector configurations scoped to another realm...

org.apache.syncope.core.idm:syncope-core-idm-rest-cxf (>=4.1.0-m0, <=4.1.2), org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=4.1.0-m0, <=4.1.2) +3 more potentially affected by CVE-2026-73370 via org.apache.syncope.core.idm:syncope-core-idm-logic (>=4.1.0-m0, <=4.1.2)

org.apache.syncope.core.idm:syncope-core-idm-logic MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.2 Source cves: CVE-2026-73370 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPECOREIDM-20186790...

org.apache.syncope.core.idm:syncope-core-idm-rest-cxf (>=3.0.0-m0, <=4.0.7), org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=3.0.0-m0, <=4.0.7) +3 more potentially affected by CVE-2026-73370 via org.apache.syncope.core.idm:syncope-core-idm-logic (>=3.0.0-m0, <=4.0.7)

org.apache.syncope.core.idm:syncope-core-idm-logic MAVEN version =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.7 Source cves: CVE-2026-73370 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPECOREIDM-20186790...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization due to incomplete security checks in the reconciliation service's pull and push processes. An attacker can gain unauthorized access to restricted resources by making calls as an administrator without the necessar...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.1.0-m0, <=4.1.2), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.1.0-m0, <=4.1.2) +18 more potentially affected by CVE-2026-73195 via org.apache.syncope.core:syncope-core-provisioning-java (>=4.1.0-m0, <=4.1.2)

org.apache.syncope.core:syncope-core-provisioning-java MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.2 -...

org.apache.syncope.core.am:syncope-core-am-logic (>=3.0.0-m0, <=4.0.7), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=3.0.0-m0, <=4.0.7) +20 more potentially affected by CVE-2026-73195 via org.apache.syncope.core:syncope-core-provisioning-java (>=3.0.0-m0, <=4.0.7)

org.apache.syncope.core:syncope-core-provisioning-java MAVEN version =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.2, =3.0.0-m0, =3.0.0-m0, =3.0.0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.7 -...

org.apache.syncope.core.idm:syncope-core-idm-rest-cxf (>=4.0.0-m0, <=4.0.7), org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=4.0.0-m0, <=4.0.7) +3 more potentially affected by CVE-2026-73370 via org.apache.syncope.core.idm:syncope-core-idm-logic (>=4.0.0-m0, <=4.0.7)

org.apache.syncope.core.idm:syncope-core-idm-logic MAVEN version =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.7 Source cves: CVE-2026-73370 Source advisory: MEND:CVE-2026-73370...

org.apache.syncope.core.idm:syncope-core-idm-rest-cxf (>=4.1.0-m0, <=4.1.2), org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=4.1.0-m0, <=4.1.2) +3 more potentially affected by CVE-2026-73370 via org.apache.syncope.core.idm:syncope-core-idm-logic (>=4.1.0-m0, <=4.1.2)

org.apache.syncope.core.idm:syncope-core-idm-logic MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.2 Source cves: CVE-2026-73370 Source advisory: MEND:CVE-2026-73370...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.0.0-m0, <=4.0.7), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.0.0-m0, <=4.0.7) +18 more potentially affected by CVE-2026-73470 via org.apache.syncope.core:syncope-core-provisioning-java (>=4.0.0-m0, <=4.0.7)

org.apache.syncope.core:syncope-core-provisioning-java MAVEN version =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.2, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.7 -...

org.apache.syncope.core.idm:syncope-core-idm-rest-cxf (>=4.0.0-m0, <=4.0.7), org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=4.0.0-m0, <=4.0.7) +3 more potentially affected by CVE-2026-73668 via org.apache.syncope.core.idm:syncope-core-idm-logic (>=4.0.0-m0, <=4.0.7)

org.apache.syncope.core.idm:syncope-core-idm-logic MAVEN version =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.7 Source cves: CVE-2026-73668 Source advisory: MEND:CVE-2026-73668...

org.apache.syncope.core.idm:syncope-core-idm-rest-cxf (>=4.1.0-m0, <=4.1.2), org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=4.1.0-m0, <=4.1.2) +3 more potentially affected by CVE-2026-73668 via org.apache.syncope.core.idm:syncope-core-idm-logic (>=4.1.0-m0, <=4.1.2)

org.apache.syncope.core.idm:syncope-core-idm-logic MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.2 Source cves: CVE-2026-73668 Source advisory: MEND:CVE-2026-73668...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.1.0-m0, <=4.1.2), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.1.0-m0, <=4.1.2) +33 more potentially affected by CVE-2026-77147 via org.apache.syncope.core:syncope-core-spring (>=4.1.0-m0, <=4.1.2)

org.apache.syncope.core:syncope-core-spring MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.2 and more Source cves: CVE-2026-77147https://vu...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.1.0-m0, <=4.1.2), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.1.0-m0, <=4.1.2) +36 more potentially affected by CVE-2026-77883 via org.apache.syncope.core:syncope-core-provisioning-api (>=4.1.0-m0, <=4.1.2)

org.apache.syncope.core:syncope-core-provisioning-api MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.2 and more Source cves:...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.0.0-m0, <=4.0.7), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.0.0-m0, <=4.0.7) +33 more potentially affected by CVE-2026-78330 via org.apache.syncope.core:syncope-core-spring (>=4.0.0-m0, <=4.0.7)

org.apache.syncope.core:syncope-core-spring MAVEN version =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.2, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.7 and more Source cves: CVE-2026-78330https://vulne...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.1.0-m0, <=4.1.2), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.1.0-m0, <=4.1.2) +33 more potentially affected by CVE-2026-87785 via org.apache.syncope.core:syncope-core-spring (>=4.1.0-m0, <=4.1.2)

org.apache.syncope.core:syncope-core-spring MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.2 and more Source cves: CVE-2026-87785https://vu...