Server-Side Request Forgery in Apache Syncope Connectors and Resources check (CVE-2026-62418)

Apache Syncope contains a Server-Side Request Forgery (SSRF) vulnerability accessible to low-privileged authenticated users via the Connectors and Resources check functionality. An attacker with minimal privileges could exploit this to induce the server to make requests to unintended internal or external destinations. Affected versions: - 3.0.0-M0 through 3.0.16 - 4.0.0-M0 through 4.0.6 - 4.1.0-M0 through 4.1.1 We recommend updating to: 4.0.7, 4.1.2. CVSS 8.1 · our assessment: this_week Reference: https://lists.apache.org/thread/n632drbsmfr6t3p6jt6jwbjvokqdyszb Details: https://vuln.today/cve/CVE-2026-62418