org.apache.syncope.core/syncope-core-persistence-common vulnerabilities

Latest org.apache.syncope.core/syncope-core-persistence-common CVEs

Newest publication first

1. CVE-2026-73579 Apache Syncope: Non-recursive Any search could skip Realms restrictions

   Published 2026-09-14

   Critical·CVSS 9.8 EPSS 0.51%

   Incorrect Authorization vulnerability in Apache Syncope. Any search requests are transformed into SQL, Neo4J or Elasticsearch / Opensearch queries, depending on the actual deployment configuration. An important component of such transformation is the Realms filter, which ensures...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.