CVE-2020-11977

What’s affected: Apache Syncope 2.1.x (before 2.1.7) with the Flowable extension enabled. Vulnerability: An administrator with workflow entitlements can use Shell Service Tasks to perform malicious operations, including file reads/writes and code execution. Root cause (per sources): Flowable work...

CVE-2026-62418

CVE-2026-62418 describes a low-privileged authenticated SSRF vulnerability in Apache Syncope, exploitable via Connectors and Resources checks. Affected versions include 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1. The issue, if exploited, can impact confidentiality...