Apache Syncope
Approved changes feed: RSS · Atom
cpe:2.3:a:apache_software_foundation:apache_syncope:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Apache Software Foundation (f563070d-e18f-561b-b86c-987936937e8a) |
|---|---|
| Product | Apache Syncope (57a9ae09-5e57-5c9d-973b-8a6496758a18) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-63071 |
vulnerable | 2026-07-29 01:06:19.261676 |
Apache Syncope: RCE via Groovy Sandbox bypass
Improper Isolation or Compartmentalization vulnerability in Apache Syncope.
An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code bypassing the Groovy security sandbox.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.6, from 4.1.0-M0 through 4.1.1.
Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue by tightening the Groovy security sandbox.
Published: 2026-07-20T14:19:19.065Z
Updated: 2026-07-21T14:57:32.285Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-62418 |
vulnerable | 2026-07-29 01:06:19.091234 |
Apache Syncope: Low-privileged authenticated SSRF in Connectors and Resources check
Low-privileged authenticated Server-Side Request Forgery (SSRF)
vulnerability in Apache Syncope via Connectors and Resources check.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1.
Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue.
Published: 2026-07-20T14:27:04.679Z
Updated: 2026-07-21T14:57:00.487Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-62183 |
vulnerable | 2026-07-29 01:06:18.980211 |
Apache Syncope: User self-service privilege escalation
Improper Privilege Management vulnerability in Apache Syncope.
When:
* the all-Java user workflow adapter is configured, or
* the Flowable user workflow adapter is configured, bearing a BPMN definition not requiring admin approval for user self registration of self update requests
the following scenario could happen.
A REST API call can allow the user to grant themselves one or more of defined Roles, thus gaining their Entitlements and becoming in fact an administrator; the actual Entitlements gained depend on the Roles that are effectively defined on the specific Syncope deployment.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1.
Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue.
Published: 2026-07-20T14:23:20.294Z
Updated: 2026-07-21T14:57:08.107Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-57308 |
vulnerable | 2026-07-29 01:00:29.580506 |
Apache Syncope: SQL injection vulnerability in Audit Events search
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope.
An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort parameters.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1.
Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue.
Published: 2026-07-20T14:21:57.415Z
Updated: 2026-07-21T14:57:14.949Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-53421 |
vulnerable | 2026-07-29 01:00:26.979570 |
Apache Syncope: Remote Code Execution via Scripted Connector
Improper Isolation or Compartmentalization vulnerability in Apache Syncope.
An administrator with adequate entitlements can achieve remote code execution through the connector subsystem by relying on scripted connectors' (REST and SQL) capability to run Groovy scripts.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1.
Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue by hardening the Groovy security sandbox.
Published: 2026-07-20T14:21:10.071Z
Updated: 2026-07-21T14:57:20.891Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-53405 |
vulnerable | 2026-07-29 01:00:26.916803 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42797 |
vulnerable | 2026-06-08 08:03:16.691998 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42782 |
vulnerable | 2026-06-08 08:03:16.674053 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-23795 |
vulnerable | 2026-06-08 07:51:16.253950 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-23794 |
vulnerable | 2026-06-08 07:51:16.252901 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-65998 |
vulnerable | 2026-06-08 07:39:21.111809 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-57738 |
vulnerable | 2026-06-08 07:33:16.021545 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-45031 |
vulnerable | 2026-06-08 06:45:54.421474 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-38503 |
vulnerable | 2026-06-08 06:41:47.428919 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-1322 |
vulnerable | 2026-06-08 05:11:17.699106 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-1321 |
vulnerable | 2026-06-08 05:11:17.687505 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-17186 |
vulnerable | 2026-06-08 05:11:06.102801 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-17184 |
vulnerable | 2026-06-08 05:11:06.101494 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.