Skip to content

Vendor

org.apache.syncope.core vulnerabilities

21 published CVES affecting org.apache.syncope.core, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
21
Critical
11
High
6
Medium
4
Low
0
Unscored
0
CISA KEV
0
Atom feed of org.apache.syncope.core alerts

Products

Latest org.apache.syncope.core CVEs

Newest publication first

  2. CVE-2026-113687 Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypass

    Published
    CriticalCVSS 9.8

    Improper isolation or compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class running untrusted code on a separate Thread, thus bypassing the Groovy security sandbox. This issue affe...

  3. CVE-2026-73195 Apache Syncope: CSV export spreadsheet formula injection

    Published
    HighCVSS 7.3

    Improper Encoding or Escaping of Output vulnerability in Apache Syncope. Authenticated users can store a spreadsheet formula payload in one of their own plain attributes. When such users are included in a CSV export and the generated CSV file is opened by a spreadsheet applicatio...

  4. CVE-2026-73178 Apache Syncope: JWT Access Token takeover

    Published
    HighCVSS 7.5

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Syncope. An administrator with adequate entitlements can get access via REST to the list of existing Access Tokens, including their signed JWT body. These values can be then used to perform further...

  5. CVE-2026-73470 Apache Syncope: Delegating users can grant unowned Roles

    Published
    CriticalCVSS 9.8

    Improper Privilege Management vulnerability in Apache Syncope. Delegations can be created or updated with Roles not owned by the delegating User, or not for the same Realm subtree under the delegation management was granted for. This issue affects Apache Syncope: from 3.0.0-M0 th...

  9. CVE-2026-77147 Apache Syncope: Groovy Sandbox escape for empty CommandArgs

    Published
    MediumCVSS 6.5

    Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy Command class containing untrusted code in their CommandArgs static implementation, bypassing t...

  12. CVE-2026-82232 Apache Syncope: SQL injection via sort parameter in Task search

    Published
    CriticalCVSS 9.8 EPSS 0.60%

    Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort clauses for Task search. This...

  14. CVE-2026-87779 Apache Syncope: AES Secret Key disclosure via log output

    Published
    HighCVSS 7.5

    Insertion of sensitive information into log file vulnerability in Apache Syncope. When AES key of non-standard length (not 16/24/32 bytes) is configured, Syncope will pad the provided value with random characters. The resulting key value is logged. This issue affects Apache Synco...

  15. CVE-2026-87785 Apache Syncope: JWT subject spoofing

    Published
    CriticalCVSS 9.1

    Authentication bypass by spoofing vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed (at least protocol and key), an attacker can spoof another user's privileges after completing a successful authentication and obtaini...

  16. CVE-2026-62183 Apache Syncope: User self-service privilege escalation

    Published
    CriticalCVSS 9.8

    Improper Privilege Management vulnerability in Apache Syncope. When: the all-Java user workflow adapter is configured, or the Flowable user workflow adapter is configured, bearing a BPMN definition not requiring admin approval for user self registration of self update requests th...

  17. CVE-2026-63071 Apache Syncope: RCE via Groovy Sandbox bypass

    Published
    CriticalCVSS 9.8

    Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code bypassing the Groovy security sandbox. This issue affects Apache Syncope: from...

  18. CVE-2026-42797 Apache Syncope: JexlContextBuilder Information Disclosure

    Published
    MediumCVSS 4.9

    Exposure of Sensitive Information Through Data Queries vulnerability in Apache Syncope. An administrator with adequate entitlements for Derived Schemas can create a malicious JEXL expression which allows any administrator with sufficient entitlements for User read to access User-...

  19. CVE-2026-42782 Apache Syncope: Post-auth RCE via Groovy static

    Published
    HighCVSS 7.2

    Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code reaching a non-sandboxed execution path via the class static initializer. This...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.