Apache
Apache Syncope: vulnerabilidades y CVE
Apache Syncope tiene 46 vulnerabilidades publicadas, 34 de ellas en los últimos 12 meses. 19 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE46
Últimos 12 meses34
Críticas19
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-73370 | Crítica (9.8) | 0.51% | — | 14 sept 2026 | Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks performed by Reconciliation service's pull and push, being incomplete, could accept calls by administrator not provided… |
| CVE-2026-73236 | Alta (7.5) | 0.36% | — | 14 sept 2026 | Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks are based on Realm hierarchy and enforced via prefix matches. Due to incorrect implementation, two sibling Realms whose… |
| CVE-2026-73195 | Alta (7.3) | 0.37% | — | 14 sept 2026 | Improper Encoding or Escaping of Output vulnerability in Apache Syncope. Authenticated users can store a spreadsheet formula payload in one of their own plain attributes. When such users are included in a CSV export and… |
| CVE-2026-73191 | Media (6.1) | 0.31% | — | 14 sept 2026 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Syncope. When the Syncope SRA is configured for CAS authentication, the target Apereo CAS instance's URL is calculated by unconditionally… |
| CVE-2026-78336 | Alta (7.5) | 0.43% | — | 14 sept 2026 | Insertion of sensitive information into sent data vulnerability in Apache Syncope. Any authenticated user can query for the list of available OIDC providers configured for SSO with Console and Enduser. The returned… |
| CVE-2026-78330 | Crítica (9.8) | 0.64% | — | 14 sept 2026 | Incorrect privilege assignment vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed (at least protocol and key), an attacker can obtain admin privileges after… |
| CVE-2026-78318 | Media (6.1) | 0.26% | — | 14 sept 2026 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Syncope. The notification message, as optionally shown by Console's and Enduser's login pages can be… |
| CVE-2026-77883 | Media (4.9) | 0.39% | — | 14 sept 2026 | Exposure of sensitive information through data queries vulnerability in Apache Syncope. An administrator with adequate entitlements for Derived Schemas can create a malicious JEXL expression which allows any… |
| CVE-2026-77181 | Crítica (9.8) | 0.51% | — | 14 sept 2026 | Incorrect Authorization vulnerability in Apache Syncope. An administrator with ClientApp's update entitlement is unable to perform the related operation, while ClientApp's create entitlement is checked both for create… |
| CVE-2026-77147 | Media (6.5) | 0.45% | — | 14 sept 2026 | Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy Command class containing untrusted… |
| CVE-2026-77051 | Crítica (9.8) | 0.60% | — | 14 sept 2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked… |
| CVE-2026-75030 | Crítica (9.8) | 0.62% | — | 14 sept 2026 | Missing Authorization vulnerability in Apache Syncope. An administrator with task execution entitlements might be able to mass (de)provision group members, regardless of their group-related administration capabilities.… |
| CVE-2026-75015 | Media (4.9) | 0.39% | — | 14 sept 2026 | Insufficiently Protected Credentials vulnerability in Apache Syncope. Audit events, when sent to the configured store, are not sufficiently masked for the sensitive values they might carry on their payloads, thus… |
| CVE-2026-73668 | Crítica (9.8) | 0.51% | — | 14 sept 2026 | Incorrect Authorization vulnerability in Apache Syncope. An administrator with adequate entitlements in a given Realm may be able to read via REST the full Connector configuration, confidential properties included,… |
| CVE-2026-73579 | Crítica (9.8) | 0.51% | — | 14 sept 2026 | Incorrect Authorization vulnerability in Apache Syncope. Any search requests are transformed into SQL, Neo4J or Elasticsearch / Opensearch queries, depending on the actual deployment configuration. An important… |
| CVE-2026-73470 | Crítica (9.8) | 0.51% | — | 14 sept 2026 | Improper Privilege Management vulnerability in Apache Syncope. Delegations can be created or updated with Roles not owned by the delegating User, or not for the same Realm subtree under the delegation management was… |
| CVE-2026-73178 | Alta (7.5) | 0.43% | — | 14 sept 2026 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Syncope. An administrator with adequate entitlements can get access via REST to the list of existing Access Tokens, including their… |
| CVE-2026-87802 | Crítica (9.1) | 0.28% | — | 14 sept 2026 | Improper verification of cryptographic signature vulnerability in Apache Syncope. When SRA is configured for OAuth 2.0 without JWKS set URI assigned, an attacker can forge arbitrary JWTs to impersonate any user identity… |
| CVE-2026-87785 | Crítica (9.1) | 0.55% | — | 14 sept 2026 | Authentication bypass by spoofing vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed (at least protocol and key), an attacker can spoof another user's… |
| CVE-2026-87779 | Alta (7.5) | 0.43% | — | 14 sept 2026 | Insertion of sensitive information into log file vulnerability in Apache Syncope. When AES key of non-standard length (not 16/24/32 bytes) is configured, Syncope will pad the provided value with random characters. The… |
| CVE-2026-86460 | Crítica (9.8) | 0.60% | — | 14 sept 2026 | Cypher injection vulnerability in the Neo4j persistence layer when processing some FIQL search conditions. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0… |
| CVE-2026-82232 | Crítica (9.8) | 0.60% | — | 14 sept 2026 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked… |
| CVE-2026-63071 | Crítica (9.8) | 0.75% | — | 20 jul 2026 | Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code bypassing the… |
| CVE-2026-62418 | Alta (8.1) | 0.47% | — | 20 jul 2026 | Low-privileged authenticated Server-Side Request Forgery (SSRF) vulnerability in Apache Syncope via Connectors and Resources check. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through… |
| CVE-2026-62183 | Crítica (9.8) | 0.69% | — | 20 jul 2026 | Improper Privilege Management vulnerability in Apache Syncope. When: * the all-Java user workflow adapter is configured, or * the Flowable user workflow adapter is configured, bearing a BPMN definition not requiring… |
| CVE-2026-57308 | Crítica (9.8) | 0.83% | — | 20 jul 2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked… |
| CVE-2026-53421 | Crítica (9.8) | 1.1% | — | 20 jul 2026 | Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve remote code execution through the connector subsystem by relying on scripted… |
| CVE-2026-53405 | Crítica (9.8) | 0.75% | — | 20 jul 2026 | Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a… |
| CVE-2026-42797 | Media (4.9) | 0.56% | — | 25 may 2026 | Exposure of Sensitive Information Through Data Queries vulnerability in Apache Syncope. An administrator with adequate entitlements for Derived Schemas can create a malicious JEXL expression which allows any… |
| CVE-2026-42782 | Alta (7.2) | 0.86% | — | 25 may 2026 | Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code reaching a… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.