SB2026091562 - Multiple vulnerabilities in Apache Syncope

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026091562

SB2026091562 - Multiple vulnerabilities in Apache Syncope

Published: September 15, 2026 Updated: September 16, 2026

Security Bulletin ID SB2026091562
CSH Severity
High
Patch available
YES
Number of vulnerabilities 22
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 5% Medium 9% Low 86%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 22 vulnerabilities.


1) Incorrect authorization (CVE-ID: CVE-2026-77181)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify ClientApps without the required update entitlement.

The vulnerability exists due to improper authorization in ClientApp entitlement checks when performing ClientApp update operations. A remote privileged user can use the ClientApp create entitlement to invoke ClientApp update operations to modify ClientApps without the required update entitlement.


2) Code Injection (CVE-ID: CVE-2026-77147)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper control of code generation in the Groovy Command class CommandArgs static implementation when creating a Groovy Command class. A remote privileged user can create a malicious Groovy Command class containing untrusted code in its CommandArgs static implementation to execute arbitrary code.


3) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-87802)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to gain full access to services proxied by SRA.

The vulnerability exists due to improper verification of cryptographic signatures in SRA OAuth 2.0 JWT signature verification when SRA is configured for OAuth 2.0 without a JWKS set URI assigned. A remote attacker can forge arbitrary JWTs to impersonate any user identity and permissions to gain full access to services proxied by SRA.


4) Improper Authentication (CVE-ID: CVE-2026-87785)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to spoof another user's privileges.

The vulnerability exists due to improper authentication in internal JWT authentication when configured JWKS settings are disclosed. A remote user can use a valid JWT after successfully authenticating to spoof another user's privileges.


5) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-87779)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to insertion of sensitive information into log files in Apache Syncope AES key handling when an AES key with a non-standard length is configured. A local user can read the logged resulting key value to disclose sensitive information.


6) Improper Neutralization of Special Elements in Data Query Logic (CVE-ID: CVE-2026-86460)

CWE-ID: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to inject Cypher statements.

The vulnerability exists due to improper neutralization of special elements in the Neo4j persistence layer when processing certain FIQL search conditions. A remote attacker can submit a crafted FIQL search condition to inject Cypher statements.


7) SQL injection (CVE-ID: CVE-2026-82232)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary SQL.

The vulnerability exists due to improper neutralization of special elements used in an SQL command in the Task search functionality when processing sort clauses. A remote privileged user can supply a crafted sort parameter to execute arbitrary SQL.


8) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-78336)

CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose OIDC client secrets.

The vulnerability exists due to insertion of sensitive information into sent data in the OIDCC4UI provider list when handling requests for configured OIDC providers. A remote user can query the provider list to disclose OIDC client secrets.


9) Improper privilege management (CVE-ID: CVE-2026-78330)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to escalate privileges to administrator privileges.

The vulnerability exists due to incorrect privilege assignment in internal JWT authentication when configured JWKS settings, including at least the protocol and key, are disclosed. A remote user can use a valid low-privilege JWT after successful authentication to obtain administrator privileges.


10) Cross-site scripting (CVE-ID: CVE-2026-78318)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to execute arbitrary JavaScript in the victim's browser.

The vulnerability exists due to improper neutralization of input during web page generation in the notification message displayed on Console and Enduser login pages when processing a malicious HTTP link. A remote attacker can generate a malicious HTTP link to execute arbitrary JavaScript in the victim's browser.

User interaction is required to open the malicious link.


11) Incomplete List of Disallowed Inputs (CVE-ID: CVE-2026-77883)

CWE-ID: CWE-184 - Incomplete List of Disallowed Inputs

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to an incomplete denylist in the JexlContextBuilder when processing derived schema JEXL expressions. A remote privileged user can create a malicious JEXL expression to access sensitive LinkedAccount or Manager information.

The disclosed information can include hashed credentials.


12) SQL injection (CVE-ID: CVE-2026-77051)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary SQL commands.

The vulnerability exists due to improper neutralization of special elements used in an SQL command in the Audit Events search functionality when processing unsanitized entityKey and opEvent parameters. A remote privileged user can submit crafted parameter values to execute arbitrary SQL commands.


13) Missing Authorization (CVE-ID: CVE-2026-75030)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to perform unauthorized mass provisioning or deprovisioning of group members.

The vulnerability exists due to missing authorization in Apache Syncope group member provisioning and deprovisioning operations when performing mass group member operations. A remote privileged user can invoke mass group member provisioning or deprovisioning operations beyond their group-related administration capabilities to perform unauthorized mass provisioning or deprovisioning of group members.


14) Insufficiently protected credentials (CVE-ID: CVE-2026-75015)

CWE-ID: CWE-522 - Insufficiently Protected Credentials

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local privileged user to disclose sensitive information.

The vulnerability exists due to insufficiently protected credentials in audit event payload masking when accessing audit events in the configured store. A local privileged user can read audit records containing sensitive values to disclose sensitive information.


15) Incorrect authorization (CVE-ID: CVE-2026-73668)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose confidential Connector configuration values from another Realm.

The vulnerability exists due to incorrect authorization in REST access control for Connector configurations when retrieving a full Connector configuration scoped to another Realm. A remote privileged user can read confidential properties through REST to disclose confidential Connector configuration values from another Realm.

The disclosed configuration can be used to duplicate the Connector instance into a Realm where the user has administration rights.


16) Incorrect authorization (CVE-ID: CVE-2026-73579)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose information outside their authorized realms.

The vulnerability exists due to improper authorization in the Realms filter for non-recursive Any searches when transforming non-recursive Any search requests into backend queries. A remote user can submit a non-recursive Any search request to disclose information outside their authorized realms.


17) Improper privilege management (CVE-ID: CVE-2026-73470)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to grant roles they do not own.

The vulnerability exists due to improper privilege management in delegation management when creating or updating delegations. A remote user can create or update a delegation with roles they do not own or roles outside the authorized realm subtree to grant roles they do not own.


18) Information disclosure (CVE-ID: CVE-2026-73178)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to impersonate users with higher administration entitlements.

The vulnerability exists due to exposure of sensitive information to an unauthorized actor in the REST access token listing functionality when accessing the list of existing access tokens via REST. A remote privileged user can retrieve signed JWT bodies from existing access tokens to impersonate users with higher administration entitlements.


19) Incorrect authorization (CVE-ID: CVE-2026-73370)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to perform unauthorized reconciliation operations.

The vulnerability exists due to incorrect authorization in the Reconciliation service's pull and push operations when handling requests from delegated administrators. A remote user can invoke reconciliation operations without adequate entitlements to perform unauthorized reconciliation operations.

The incomplete security checks affect cross-realm boundaries.


20) Incorrect authorization (CVE-ID: CVE-2026-73236)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass cross-realm authorization restrictions.

The vulnerability exists due to incorrect authorization in delegated administration realm hierarchy security checks when handling delegated administration requests for sibling realms whose names begin with the same string. A remote user can exploit prefix matching to bypass cross-realm authorization restrictions.


21) Improper Neutralization of Formula Elements in a CSV File (CVE-ID: CVE-2026-73195)

CWE-ID: CWE-1236 - Improper Neutralization of Formula Elements in a CSV File

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute spreadsheet formulas.

The vulnerability exists due to improper encoding or escaping of output in the CSV export feature when a generated CSV file is opened by a spreadsheet application. A remote user can store a spreadsheet formula payload in one of their own plain attributes to execute spreadsheet formulas.


22) Open redirect (CVE-ID: CVE-2026-73191)

CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to redirect users to an untrusted site.

The vulnerability exists due to improper validation of client-supplied forwarded HTTP headers in the CAS service URL calculation of Syncope SRA when handling forwarded HTTP headers. A remote attacker can supply crafted Forwarded HTTP headers to redirect users to an untrusted site.

The issue occurs when Syncope SRA is configured for CAS authentication.


Remediation

Install update from vendor's website.

References