Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 4 total.
Server-Side Request Forgery in Apache Syncope Connectors and Resources check (CVE-2026-62418)
Apache Syncope contains a Server-Side Request Forgery (SSRF) vulnerability accessible to low-privileged authenticated users via the Connectors and Resources check functionality. An attacker with minimal privileges cou...
Fixed in 4.0.7; 4.1.2
Groovy sandbox bypass enabling RCE in Apache Syncope (CVE-2026-63071)
Apache Syncope contains an Improper Isolation or Compartmentalization vulnerability in its Groovy security sandbox. An administrator with adequate entitlements for Implementations can create a malicious Groovy class c...
Fixed in 4.0.7; 4.1.2
Remote code execution via unsandboxed Groovy scriptTask in Apache Syncope (CVE-2026-53405)
Apache Syncope contains an improper isolation vulnerability in its Flowable BPMN extension that allows an administrator with adequate entitlements to import arbitrary BPMN process definitions via the REST API. When a ...
Fixed in 4.0.7; 4.1.2
Remote code execution via scripted connector in Apache Syncope (CVE-2026-53421)
Apache Syncope contains an improper isolation or compartmentalization vulnerability in its connector subsystem. An administrator with adequate entitlements can achieve remote code execution by exploiting scripted conn...
Fixed in 4.0.7; 4.1.2