CVE-2026-42797

CVE-2026-42797 (Apache Syncope) exposes a data-query related information disclosure via a misconfigured JEXL expression. An administrator with entitlements for Derived Schemas can craft a malicious JEXL expression that, if the requester also has User-read privileges, may access security-sensitive...

CVE-2026-42782

CVE-2026-42782 affects Apache Syncope 3.0–3.0.16, 4.0–4.0.5, and 4.1.0, caused by improper isolation that lets an administrator with sufficient entitlements load a malicious Groovy class whose static initializer reaches a non-sandboxed execution path. Remediation is to upgrade to 4.0.6 or 4.1.1, ...

CVE-2026-63071

Apache Syncope suffers an RCE via Groovy Sandbox bypass (Improper Isolation). A privileged user can craft a malicious Groovy class that executes untrusted code, bypassing the Groovy sandbox. Affected versions: 3.0.0-M0–3.0.16; 4.0.0-M0–4.0.6; 4.1.0-M0–4.1.1. Fixes are available in versions 4.0.7 ...

CVE-2026-53405

Apache Syncope is affected by CVE-2026-53405 where importing and starting BPMN processes containing a Groovy scriptTask enables the script to execute on the server without sandboxing. Affected versions: 3.0.0-M0–3.0.16, 4.0.0-M0–4.0.6, 4.1.0-M0–4.1.1. The issue arises from improper isolation, ena...

CVE-2026-23795

CVE-2026-23795 describes an XML External Entity (XXE) vulnerability in the Apache Syncope Console. An administrator with sufficient entitlements to create or edit Keymaster parameters can craft malicious XML text to trigger XXE, potentially leaking sensitive data. Affected versions: Apache Syncop...

CVE-2026-62418

CVE-2026-62418 describes a low-privileged authenticated SSRF vulnerability in Apache Syncope, exploitable via Connectors and Resources checks. Affected versions include 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1. The issue, if exploited, can impact confidentiality...

CVE-2026-62183

CVE-2026-62183 describes an Improper Privilege Management flaw in Apache Syncope. When the all-Java user workflow adapter or the Flowable user workflow adapter is used with a BPMN that does not require admin approval for self-registration or self-update requests, a REST call can let a user grant ...

CVE-2026-23794

Summary: CVE-2026-23794 is a reflected XSS affecting Apache Syncope Enduser Login page. A attacker can lure a user to click a crafted link and, upon login, potentially steal credentials. Affected versions: 3.0–3.0.15 and 4.0–4.0.3. Remediation: upgrade to 3.0.16 or 4.0.4 (or later). The CVSS v3.1...

CVE-2026-57308

CVE-2026-57308 is an SQL injection in Apache Syncope where an administrator can trigger arbitrary SQL through unsanitized sort parameters via stacked queries. Affected versions: 3.0.0-M0–3.0.16, 4.0.0-M0–4.0.6, and 4.1.0-M0–4.1.1. Upgrading to 4.0.7 or 4.1.2 mitigates the issue. The impact is hig...

CVE-2026-53421

CVE-2026-53421 affects Apache Syncope: remote code execution is possible by an administrator with adequate entitlements through the connector subsystem via scripted Groovy scripts (REST/SQL) in connectors. Affected versions: 3.0.0-M0–3.0.16, 4.0.0-M0–4.0.6, and 4.1.0-M0–4.1.1. The issue stems fro...