What’s Vulnerable › Products

Apache Software Foundation Apache Syncope vulnerabilities

46 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 34 published in the last 12 months.

Check whether your Apache Software Foundation Apache Syncope version is affected

Latest Apache Software Foundation Apache Syncope vulnerabilities

• CVE-2026-73370 — Apache Syncope: Cross-Realm boundaries reconciliation bypass (CVSS 9.8)
• CVE-2026-73236 — Apache Syncope: Cross-Realm authorization bypass in delegated administration (CVSS 7.5)
• CVE-2026-73195 — Apache Syncope: CSV export spreadsheet formula injection (CVSS 7.3)
• CVE-2026-73191 — Apache Syncope: CAS service URL injection via Forwarded HTTP headers (CVSS 6.1)
• CVE-2026-78336 — Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user (CVSS 7.5)
• CVE-2026-78330 — Apache Syncope: Privilege escalation for admin user via JWT authentication (CVSS 9.8)
• CVE-2026-78318 — Apache Syncope: Unauthenticated reflected XSS in Console and Enduser (CVSS 6.1)
• CVE-2026-77883 — Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist (CVSS 4.9)
• CVE-2026-77181 — Apache Syncope: ClientApp update entitlement not effective (CVSS 9.8)
• CVE-2026-77147 — Apache Syncope: Groovy Sandbox escape for empty CommandArgs (CVSS 6.5)
• CVE-2026-77051 — Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search (CVSS 9.8)
• CVE-2026-75030 — Apache Syncope: Incomplete authorization checks for Group members deprovisioning (CVSS 9.8)
• CVE-2026-75015 — Apache Syncope: Nested secrets leak cleartext into audit records readable (CVSS 4.9)
• CVE-2026-73668 — Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values (CVSS 9.8)
• CVE-2026-73579 — Apache Syncope: Non-recursive Any search could skip Realms restrictions (CVSS 9.8)
• CVE-2026-73470 — Apache Syncope: Delegating users can grant unowned Roles (CVSS 9.8)
• CVE-2026-73178 — Apache Syncope: JWT Access Token takeover (CVSS 7.5)
• CVE-2026-87802 — Apache Syncope: SRA OAuth2 JWT signature verification bypass (CVSS 9.1)
• CVE-2026-87785 — Apache Syncope: JWT subject spoofing (CVSS 9.1)
• CVE-2026-87779 — Apache Syncope: AES Secret Key disclosure via log output (CVSS 7.5)
• CVE-2026-86460 — Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence (CVSS 9.8)
• CVE-2026-82232 — Apache Syncope: SQL injection via sort parameter in Task search (CVSS 9.8)
• CVE-2026-63071 — Apache Syncope: RCE via Groovy Sandbox bypass (CVSS 9.8)
• CVE-2026-62418 — Apache Syncope: Low-privileged authenticated SSRF in Connectors and Resources check (CVSS 8.1)
• CVE-2026-62183 — Apache Syncope: User self-service privilege escalation (CVSS 9.8)