Apache Syncope security advisories

Security information for Apache Syncope

Reporting

Do you want disclose a potential security issue for Apache Syncope? Send your report to the Apache Security Team.

You can read more about the security policy on:

Advisories

This section is experimental: it provides advisories since 2023 and may lag behind the official CVE publications. It may also lack details found on the project security page linked above. If you have any feedback on how you would like this data to be provided, you are welcome to reach out on our public mailinglist or privately on security@apache.org

RCE via Groovy Sandbox bypass

CVE-2026-63071 [CVE] [CVE json] [OSV json]

Last updated: 2026-07-20T14:19:15.560Z

Affected

  • Apache Syncope from 3.0.0-M0 through 3.0.16
  • Apache Syncope from 4.0.0-M0 through 4.0.6
  • Apache Syncope from 4.1.0-M0 through 4.1.1

Description

Improper Isolation or Compartmentalization vulnerability in Apache Syncope.

An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code bypassing the Groovy security sandbox.

This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.6, from 4.1.0-M0 through 4.1.1.

Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue by tightening the Groovy security sandbox.

References

Credits

  • elin kai (finder)
  • 无聊 (finder)

Low-privileged authenticated SSRF in Connectors and Resources check

CVE-2026-62418 [CVE] [CVE json] [OSV json]

Last updated: 2026-07-20T14:27:00.668Z

Affected

  • Apache Syncope from 3.0.0-M0 through 3.0.16
  • Apache Syncope from 4.0.0-M0 through 4.0.6
  • Apache Syncope from 4.1.0-M0 through 4.1.1

Description

Low-privileged authenticated Server-Side Request Forgery (SSRF) vulnerability in Apache Syncope via Connectors and Resources check.

This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1.

Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue.

References

Credits

  • Adrián Leal Castaño (finder)

User self-service privilege escalation

CVE-2026-62183 [CVE] [CVE json] [OSV json]

Last updated: 2026-07-20T14:23:15.458Z

Affected

  • Apache Syncope from 3.0.0-M0 through 3.0.16
  • Apache Syncope from 4.0.0-M0 through 4.0.6
  • Apache Syncope from 4.1.0-M0 through 4.1.1

Description

Improper Privilege Management vulnerability in Apache Syncope.

When:

* the all-Java user workflow adapter is configured, or
* the Flowable user workflow adapter is configured, bearing a BPMN definition not requiring admin approval for user self registration of self update requests

the following scenario could happen.
A REST API call can allow the user to grant themselves one or more of defined Roles, thus gaining their Entitlements and becoming in fact an administrator; the actual Entitlements gained depend on the Roles that are effectively defined on the specific Syncope deployment.

This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1.

Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue.

References

Credits

  • Nic Jones (finder)
  • elin kai (finder)

SQL injection vulnerability in Audit Events search

CVE-2026-57308 [CVE] [CVE json] [OSV json]

Last updated: 2026-07-20T14:21:50.872Z

Affected

  • Apache Syncope from 3.0.0-M0 through 3.0.16
  • Apache Syncope from 4.0.0-M0 through 4.0.6
  • Apache Syncope from 4.1.0-M0 through 4.1.1

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope.

An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort parameters.

This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1.

Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue.

References

Credits

  • Lennart Hostettler (finder)

Remote Code Execution via Scripted Connector

CVE-2026-53421 [CVE] [CVE json] [OSV json]

Last updated: 2026-07-20T14:21:06.192Z

Affected

  • Apache Syncope from 3.0.0-M0 through 3.0.16
  • Apache Syncope from 4.0.0-M0 through 4.0.6
  • Apache Syncope from 4.1.0-M0 through 4.1.1

Description

Improper Isolation or Compartmentalization vulnerability in Apache Syncope.

An administrator with adequate entitlements can achieve remote code execution through the connector subsystem by relying on scripted connectors' (REST and SQL) capability to run Groovy scripts.

This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1.

Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue by hardening the Groovy security sandbox.

References

Credits

  • follycat, Y0n3er (finder)

Remote Code Execution via Flowable BPMN Groovy ScriptTask

CVE-2026-53405 [CVE] [CVE json] [OSV json]

Last updated: 2026-07-20T14:20:04.039Z

Affected

  • Apache Syncope from 3.0.0-M0 through 3.0.16
  • Apache Syncope from 4.0.0-M0 through 4.0.6
  • Apache Syncope from 4.1.0-M0 through 4.1.1

Description

Improper Isolation or Compartmentalization vulnerability in Apache Syncope.

An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a Groovy scriptTask is imported and started, the Groovy script is executed directly on the server, with no sandbox.

This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1.

Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue by wrapping Flowable's Groovy scriptTasks with security sandbox.

References

Credits

  • follycat, Y0n3er (finder)

JexlContextBuilder Information Disclosure

CVE-2026-42797 [CVE] [CVE json] [OSV json]

Last updated: 2026-05-25T15:01:00.581Z

Affected

  • Apache Syncope from 3.0 through 3.0.16
  • Apache Syncope from 4.0 through 4.0.5
  • Apache Syncope from 4.1 through 4.1.0

Description

Exposure of Sensitive Information Through Data Queries vulnerability in Apache Syncope.

An administrator with adequate entitlements for Derived Schemas can create a malicious JEXL expression which allows any administrator with sufficient entitlements for User read to access User-related security-sensitive information.

This issue affects Apache Syncope: 3.0 through 3.0.16, 4.0 through 4.0.5, 4.1.0.

Users are recommended to upgrade to version 4.0.6 / 4.1.1, which fix this issue by further restricting the JEXL expression definition.

References

Credits

  • elin kai (finder)

Post-auth RCE via Groovy static

CVE-2026-42782 [CVE] [CVE json] [OSV json]

Last updated: 2026-05-25T14:59:04.113Z

Affected

  • Apache Syncope from 3.0 through 3.0.16
  • Apache Syncope from 4.0 through 4.0.5
  • Apache Syncope from 4.1 through 4.1.0

Description

Improper Isolation or Compartmentalization vulnerability in Apache Syncope.

An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code reaching a non-sandboxed execution path via the class static initializer.

This issue affects Apache Syncope: 3.0 through 3.0.16, 4.0 through 4.0.5, 4.1.0.

Users are recommended to upgrade to version 4.0.6 / 4.1.1, which fix this issue by forcing even the static initializer in Groovy code to run in a sandbox.

References

Credits

  • Trung Nguyen, CyStack (finder)

Console XXE on Keymaster parameters

CVE-2026-23795 [CVE] [CVE json] [OSV json]

Last updated: 2026-02-03T15:14:33.685Z

Affected

  • Apache Syncope from 3.0 through 3.0.15
  • Apache Syncope from 4.0 through 4.0.3

Description

Improper Restriction of XML External Entity Reference vulnerability in Apache Syncope Console.
An administrator with adequate entitlements to create or edit Keymaster parameters via Console can construct malicious XML text to launch an XXE attack, thereby causing sensitive data leakage occurs.

This issue affects Apache Syncope: from 3.0 through 3.0.15, from 4.0 through 4.0.3.

Users are recommended to upgrade to version 3.0.16 / 4.0.4, which fix this issue.

References

Credits

  • follycat (finder)
  • Y0n3er (finder)

Reflected XSS on Enduser Login

CVE-2026-23794 [CVE] [CVE json] [OSV json]

Last updated: 2026-02-03T15:15:22.918Z

Affected

  • Apache Syncope from 3.0 through 3.0.15
  • Apache Syncope from 4.0 through 4.0.3

Description

Reflected XSS in Apache Syncope's Enduser Login page.
An attacker that tricks a legitimate user into clicking a malicious link and logging in to Syncope Enduser could steal that user's credentials.

This issue affects Apache Syncope: from 3.0 through 3.0.15, from 4.0 through 4.0.3.

Users are recommended to upgrade to version 3.0.16 / 4.0.4, which fix this issue.

References

Credits

  • Kasper Karlsson (finder)
  • Karin Taliga (finder)

Default AES key used for internal password encryption

CVE-2025-65998 [CVE] [CVE json] [OSV json]

Last updated: 2025-11-24T13:46:58.386Z

Affected

  • Apache Syncope from 2.1 through 2.1.14
  • Apache Syncope from 3.0 through 3.0.14
  • Apache Syncope from 4.0 through 4.0.2

Description

Apache Syncope can be configured to store the user password values in the internal database with AES encryption, though this is not the default option.

When AES is configured, the default key value, hard-coded in the source code, is always used. This allows a malicious attacker, once obtained access to the internal database content, to reconstruct the original cleartext password values.
This is not affecting encrypted plain attributes, whose values are also stored using AES encryption.

Users are recommended to upgrade to version 3.0.15 / 4.0.3, which fix this issue.

References

Credits

  • Clemens Bergmann (Technical University of Darmstadt) (finder)

Remote Code Execution by delegated administrators

CVE-2025-57738 [CVE] [CVE json] [OSV json]

Last updated: 2025-10-20T14:43:38.022Z

Affected

  • Apache Syncope from 2.1 through 2.1.14
  • Apache Syncope from 3.0 through 3.0.13
  • Apache Syncope from 4.0 through 4.0.1

Description

Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide custom implementations of a few Java interfaces; such implementations can be provided either as Java or Groovy classes, with the latter being particularly attractive as the machinery is set for runtime reload.
Such a feature has been available for a while, but recently it was discovered that a malicious administrator can inject Groovy code that can be executed remotely by a running Apache Syncope Core instance.
Users are recommended to upgrade to version 3.0.14 / 4.0.2, which fix this issue by forcing the Groovy code to run in a sandbox.

References

Credits

  • Mike Cole (Mantel Group) (finder)

Stored XSS in Console and Enduser

CVE-2024-45031 [CVE] [CVE json] [OSV json]

Last updated: 2025-09-01T09:41:27.665Z

Affected

  • Apache Syncope from 2.1 through 2.1.14
  • Apache Syncope from 3.0 through 3.0.8

Description

When editing objects in the Syncope Console, incomplete HTML tags could be used to bypass HTML sanitization. This made it possible to inject stored XSS payloads which would trigger for other users during ordinary usage of the application.
XSS payloads could also be injected in Syncope Enduser when editing “Personal Information” or “User Requests”: such payloads would trigger for administrators in Syncope Console, thus enabling session hijacking.

Users are recommended to upgrade to version 3.0.9, which fixes this issue.

References

Credits

  • Kasper Karlsson, Omegapoint (finder)
  • Pontus Hanssen, Omegapoint (finder)

HTML tags can be injected into Console or Enduser text fields

CVE-2024-38503 [CVE] [CVE json] [OSV json]

Last updated: 2024-09-11T11:11:10.160Z

Affected

  • Apache Syncope from 2.1 through 2.1.14
  • Apache Syncope from 3.0 through 3.0.7

Description

When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits.
The same vulnerability was found in the Syncope Enduser, when editing “Personal Information” or “User Requests”.

Users are recommended to upgrade to version 3.0.8, which fixes this issue.

References

Credits

  • Basalt IT-Security Team (finder)