Apache Syncope CVE-2026-78318

The optional notification message feature must be active and rendered on the Syncope Console or Enduser login page - it is described as 'optionally shown,' so deployments that have this feature disabled are not exposed. The attacker must be able to influence the notification message content via a crafted HTTP link (suggesting a reflected injection vector via a URL parameter or query string). A victim user must follow the crafted link to the login page (UI:R per CVSS), limiting the attack to a social-engineering or phishing delivery mechanism. No attacker authentication is required (PR:N). Exploitation is limited to deployments where the Syncope Console or Enduser interface is network-accessible to potential victims.

The NVD-assigned CVSS 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) is a reasonable baseline for a reflected XSS on a login page: network-reachable, no attacker privileges required, but requiring victim interaction (UI:R) and producing only partial confidentiality and integrity impact. The Scope:Changed metric correctly captures that injected JavaScript executes in the victim's browser origin, crossing the boundary from the vulnerable server to the client. SSVC signals reinforce low urgency: Exploitation is listed as none, the attack is not automatable (consistent with UI:R), and technical impact is partial. No CISA KEV listing and no public POC exist at time of analysis. EPSS data was not provided in the input. Even a mid-sized municipal IT team in opole should treat this as a routine patch-cycle item rather than an emergency response, given the mandatory user-interaction requirement that prevents mass automated exploitation and the availability of a vendor-released fix.

An attacker crafts a URL targeting the Syncope Console or Enduser login page that injects an HTML payload (such as an inline <script> block or an onerror event handler) into the notification message parameter. The attacker delivers this link to a legitimate Syncope user - such as an IT administrator - via phishing email or a compromised internal page. When the victim opens the link, the injected script executes in their browser, exfiltrating session cookies or capturing credentials entered on the login page. No public POC exists at time of analysis.