Apache Syncope
Monthly
CSV formula injection in Apache Syncope allows authenticated low-privilege users to embed spreadsheet formula payloads in their own user attributes. When an administrator exports users to CSV and opens the file in a spreadsheet application such as Microsoft Excel or LibreOffice Calc, the stored formula is evaluated in the spreadsheet's execution context - enabling data exfiltration from the spreadsheet or arbitrary command execution on the administrator's workstation. No public exploit code has been identified at time of analysis, and SSVC classifies exploitation status as none and not automatable.
Incorrect authorization in Apache Syncope's delegated administration module allows an authenticated delegated administrator to exercise privileges over a sibling Realm they were never granted access to, by exploiting a prefix-string matching flaw in the Realm hierarchy enforcement code. Affected releases span the entire 3.0.x (through 3.0.16), 4.0.x (through 4.0.7), and 4.1.x (through 4.1.2) branches. No public exploit has been identified and SSVC confirms no active exploitation; vendor-released patches 4.0.8 and 4.1.3 are available and should be applied promptly by any organization using delegated multi-tenant Realm structures.
Broken delegated-administration authorization in Apache Syncope's Reconciliation service lets an authenticated administrator invoke pull and push operations without holding the required entitlements, because the entitlement checks on those endpoints are incomplete. The flaw affects Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2, and is fixed in 4.0.8 and 4.1.3. There is no public exploit identified at time of analysis and SSVC records exploitation status as none, though CISA's framework rates the technical impact as total and the weakness as automatable.
Privilege escalation in Apache Syncope's internal JWT authentication (CWE-266) lets a low-privileged authenticated user obtain full administrator rights when the JWKS settings used to sign internal JWTs are disclosed. It affects Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2, and is fixed in 4.0.8 and 4.1.3. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as none, though the flaw is assessed as automatable with total technical impact.
OIDC client secret exposure in Apache Syncope enables any authenticated user to retrieve complete OIDC provider configurations - including OAuth 2.0 client secrets - via the SSO provider listing API, regardless of the caller's assigned entitlements or role. Affected versions span 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. No public exploit has been identified at time of analysis, and vendor-released patches are available as versions 4.0.8 and 4.1.3 per the Apache advisory.
SQL injection in Apache Syncope's Task search endpoint allows an authenticated administrator to execute arbitrary SQL through unsanitized sort clause parameters via stacked queries, affecting all 3.0.x releases through 3.0.16, 4.0.x through 4.0.7, and 4.1.x through 4.1.2. The vulnerability (CWE-89) enables stacked-query injection that can read, modify, or delete identity governance data, and may allow schema manipulation or OS-level operations depending on the database engine and driver configuration. No public exploit has been identified at time of analysis, and exploitation is constrained to administrators with sufficient entitlements.
Cypher injection in Apache Syncope's Neo4j graph database persistence layer allows attackers to craft malicious FIQL search queries that escape intended query boundaries, potentially exposing or manipulating identity governance data. All three active release branches are affected - 3.0.x through 3.0.16, 4.0.x through 4.0.7, and 4.1.x through 4.1.2 - indicating a longstanding architectural deficiency in the FIQL-to-Cypher translation path. No public exploit has been identified at time of analysis, but injection flaws in identity management systems carry elevated risk due to the sensitivity of stored credentials, roles, and relationships.
Sensitive AES key material is written in plaintext to Apache Syncope application logs under a specific misconfiguration condition. When an operator configures an AES key whose byte length deviates from standard values (16, 24, or 32 bytes), Syncope silently pads it with random characters to reach a valid length - and then logs the resulting padded key value. Any party with access to the application logs (e.g., log aggregation systems, monitoring personnel, or local server access) can recover the full AES encryption key, potentially allowing decryption of data protected by that key. No public exploit has been identified at time of analysis; vendor-released patches exist in versions 4.0.8 and 4.1.3.
JWT privilege-spoofing in Apache Syncope allows an authenticated attacker to impersonate any other user if the internal JWKS configuration (at minimum the signing protocol and key) has been disclosed. The attacker must first complete a legitimate authentication and obtain a valid JWT, then leverage the disclosed JWKS material to forge tokens carrying another user's identity claims. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the impact is complete horizontal and vertical privilege escalation within the identity governance platform.
JWT signature bypass in Apache Syncope's SRA (Syncope Reverse Application) component enables unauthenticated network attackers to forge arbitrary JWT bearer tokens when the OAuth 2.0 integration is configured without a JWKS set URI, effectively eliminating all cryptographic identity verification for services proxied through SRA. The vulnerability spans three release lines - 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 - and vendor-released fixes are available in 4.0.8 and 4.1.3. No CISA KEV listing or confirmed public exploit code has been identified at time of analysis.
Server-Side Request Forgery in Apache Syncope lets a low-privileged authenticated user abuse the Connectors and Resources connectivity check to coerce the server into issuing arbitrary outbound requests. Affected builds span the 3.0.x, 4.0.x, and 4.1.x lines up to 3.0.16, 4.0.6, and 4.1.1 respectively, with high confidentiality and integrity impact per the CVSS 8.1 rating. There is no public exploit identified at time of analysis, and CISA SSVC scores exploitation as 'none,' but the total technical impact and low privilege bar make this a meaningful internal-network exposure.
Privilege escalation in Apache Syncope's identity-management engine lets a self-service user grant themselves defined Roles via a single REST API call, effectively promoting a low-privileged or newly self-registered account to administrator. It affects deployments running the all-Java user workflow adapter, or the Flowable adapter with a BPMN definition that does not require admin approval for self-registration or self-update, across versions 3.0.0-M0-3.0.16, 4.0.0-M0-4.0.6, and 4.1.0-M0-4.1.1. The Apache-issued advisory rates it CVSS 9.8; no public exploit identified at time of analysis and it is not on CISA KEV.
SQL injection in Apache Syncope allows an administrator holding sufficient entitlements to execute arbitrary SQL through stacked queries by abusing unsanitized sort parameters, affecting the 3.0.x, 4.0.x, and 4.1.x branches up to 3.0.16, 4.0.6, and 4.1.1 respectively. Because stacked queries are supported, an attacker can go beyond data theft to modify or destroy identity data and potentially chain to further backend compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; note the NVD CVSS 9.8 (PR:N) contradicts the vendor description, which explicitly requires an authenticated privileged administrator.
Remote code execution in Apache Syncope's connector subsystem allows an administrator holding sufficient entitlements to run arbitrary Groovy scripts through scripted REST and SQL connectors, escaping the intended sandbox and executing code on the host. It affects Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1, and is rooted in improper isolation (CWE-653) of the scripting engine. Although the published CVSS is 9.8, the vendor description states an authenticated privileged administrator is required, and there is no public exploit identified at time of analysis.
Remote code execution in Apache Syncope's workflow engine lets an administrator holding sufficient entitlements run arbitrary Groovy code on the server by importing and starting a malicious BPMN process definition through the REST API. Because Flowable's Groovy scriptTasks execute with no sandbox in affected 3.0.x, 4.0.x, and 4.1.x releases, script code embedded in the process runs directly with the privileges of the Syncope core JVM. No public exploit has been identified at time of analysis and the flaw is not in CISA KEV, but the trivial exploitation path once an entitled admin account is reached makes it a strong candidate for post-compromise abuse and insider misuse.
Groovy sandbox escape in Apache Syncope's Implementations feature lets an administrator holding Implementation entitlements author a malicious Groovy class that runs untrusted code outside the intended security sandbox, effectively achieving arbitrary code execution on the identity-management server. It affects Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the published CVSS of 9.8 overstates real-world exposure because the flaw requires a privileged administrator account.
Code execution via Groovy sandbox bypass in Apache Syncope 3.0 through 3.0.16, 4.0 through 4.0.5, and 4.1.0 allows a high-privileged administrator holding Implementations entitlements to run untrusted code outside the sandbox. By placing payload logic in a Groovy class static initializer, the attacker reaches a non-sandboxed execution path, yielding full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and EPSS is very low (0.02%, 6th percentile), consistent with a privilege-gated, not mass-scanned, issue.
Open redirect in Apache Syncope's SRA (Secure Remote Access) component allows unauthenticated network attackers to redirect authenticated users to attacker-controlled URLs during CAS SSO login flows. The vulnerability arises because Syncope SRA unconditionally trusts client-supplied forwarded HTTP headers (e.g. X-Forwarded-Host, X-Forwarded-Proto) when constructing the target Apereo CAS instance URL, enabling header-injection-based phishing attacks that can harvest credentials. Exploitation requires user interaction and the CAS authentication configuration to be active; no public exploit or active exploitation has been identified at time of analysis.
Sensitive information exposure in Apache Syncope allows a privileged administrator with Derived Schema entitlements to craft a malicious JEXL (Java Expression Language) expression that, when evaluated during User read operations, leaks LinkedAccount or Manager sensitive data - including hashed credentials - to any admin with User read access. Affected versions span three release lines: 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. No public exploit code has been identified and CISA has not listed this in KEV; exploitation requires high-privilege access, limiting real-world risk to insider threats or compromised admin accounts.
Cross-site scripting in Apache Syncope's Console and Enduser login pages allows unsanitized HTML and JavaScript to be rendered via a maliciously crafted notification message link. Versions 4.0.4 through 4.0.7 and 4.1.0-M0 through 4.1.2 are affected. An attacker who can deliver a crafted HTTP link to a Syncope user can execute arbitrary JavaScript in that user's browser upon visiting the login page, enabling session hijacking, credential theft, or UI redress attacks.
Malicious JEXL expression injection in Apache Syncope's Derived Schema feature enables privileged information disclosure across administrative roles. An administrator holding entitlements over Derived Schemas can embed a crafted JEXL expression that, when evaluated in the context of another administrator's User read operation, exposes security-sensitive User attributes that would not normally be accessible. Affected versions span three release lines (3.0.x through 3.0.16, 4.0.x through 4.0.5, and 4.1.0); no active exploitation is confirmed (no CISA KEV listing) and the EPSS score of 0.02% places this in the 4th percentile for exploitation probability.
CSV formula injection in Apache Syncope allows authenticated low-privilege users to embed spreadsheet formula payloads in their own user attributes. When an administrator exports users to CSV and opens the file in a spreadsheet application such as Microsoft Excel or LibreOffice Calc, the stored formula is evaluated in the spreadsheet's execution context - enabling data exfiltration from the spreadsheet or arbitrary command execution on the administrator's workstation. No public exploit code has been identified at time of analysis, and SSVC classifies exploitation status as none and not automatable.
Incorrect authorization in Apache Syncope's delegated administration module allows an authenticated delegated administrator to exercise privileges over a sibling Realm they were never granted access to, by exploiting a prefix-string matching flaw in the Realm hierarchy enforcement code. Affected releases span the entire 3.0.x (through 3.0.16), 4.0.x (through 4.0.7), and 4.1.x (through 4.1.2) branches. No public exploit has been identified and SSVC confirms no active exploitation; vendor-released patches 4.0.8 and 4.1.3 are available and should be applied promptly by any organization using delegated multi-tenant Realm structures.
Broken delegated-administration authorization in Apache Syncope's Reconciliation service lets an authenticated administrator invoke pull and push operations without holding the required entitlements, because the entitlement checks on those endpoints are incomplete. The flaw affects Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2, and is fixed in 4.0.8 and 4.1.3. There is no public exploit identified at time of analysis and SSVC records exploitation status as none, though CISA's framework rates the technical impact as total and the weakness as automatable.
Privilege escalation in Apache Syncope's internal JWT authentication (CWE-266) lets a low-privileged authenticated user obtain full administrator rights when the JWKS settings used to sign internal JWTs are disclosed. It affects Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2, and is fixed in 4.0.8 and 4.1.3. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as none, though the flaw is assessed as automatable with total technical impact.
OIDC client secret exposure in Apache Syncope enables any authenticated user to retrieve complete OIDC provider configurations - including OAuth 2.0 client secrets - via the SSO provider listing API, regardless of the caller's assigned entitlements or role. Affected versions span 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. No public exploit has been identified at time of analysis, and vendor-released patches are available as versions 4.0.8 and 4.1.3 per the Apache advisory.
SQL injection in Apache Syncope's Task search endpoint allows an authenticated administrator to execute arbitrary SQL through unsanitized sort clause parameters via stacked queries, affecting all 3.0.x releases through 3.0.16, 4.0.x through 4.0.7, and 4.1.x through 4.1.2. The vulnerability (CWE-89) enables stacked-query injection that can read, modify, or delete identity governance data, and may allow schema manipulation or OS-level operations depending on the database engine and driver configuration. No public exploit has been identified at time of analysis, and exploitation is constrained to administrators with sufficient entitlements.
Cypher injection in Apache Syncope's Neo4j graph database persistence layer allows attackers to craft malicious FIQL search queries that escape intended query boundaries, potentially exposing or manipulating identity governance data. All three active release branches are affected - 3.0.x through 3.0.16, 4.0.x through 4.0.7, and 4.1.x through 4.1.2 - indicating a longstanding architectural deficiency in the FIQL-to-Cypher translation path. No public exploit has been identified at time of analysis, but injection flaws in identity management systems carry elevated risk due to the sensitivity of stored credentials, roles, and relationships.
Sensitive AES key material is written in plaintext to Apache Syncope application logs under a specific misconfiguration condition. When an operator configures an AES key whose byte length deviates from standard values (16, 24, or 32 bytes), Syncope silently pads it with random characters to reach a valid length - and then logs the resulting padded key value. Any party with access to the application logs (e.g., log aggregation systems, monitoring personnel, or local server access) can recover the full AES encryption key, potentially allowing decryption of data protected by that key. No public exploit has been identified at time of analysis; vendor-released patches exist in versions 4.0.8 and 4.1.3.
JWT privilege-spoofing in Apache Syncope allows an authenticated attacker to impersonate any other user if the internal JWKS configuration (at minimum the signing protocol and key) has been disclosed. The attacker must first complete a legitimate authentication and obtain a valid JWT, then leverage the disclosed JWKS material to forge tokens carrying another user's identity claims. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the impact is complete horizontal and vertical privilege escalation within the identity governance platform.
JWT signature bypass in Apache Syncope's SRA (Syncope Reverse Application) component enables unauthenticated network attackers to forge arbitrary JWT bearer tokens when the OAuth 2.0 integration is configured without a JWKS set URI, effectively eliminating all cryptographic identity verification for services proxied through SRA. The vulnerability spans three release lines - 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 - and vendor-released fixes are available in 4.0.8 and 4.1.3. No CISA KEV listing or confirmed public exploit code has been identified at time of analysis.
Server-Side Request Forgery in Apache Syncope lets a low-privileged authenticated user abuse the Connectors and Resources connectivity check to coerce the server into issuing arbitrary outbound requests. Affected builds span the 3.0.x, 4.0.x, and 4.1.x lines up to 3.0.16, 4.0.6, and 4.1.1 respectively, with high confidentiality and integrity impact per the CVSS 8.1 rating. There is no public exploit identified at time of analysis, and CISA SSVC scores exploitation as 'none,' but the total technical impact and low privilege bar make this a meaningful internal-network exposure.
Privilege escalation in Apache Syncope's identity-management engine lets a self-service user grant themselves defined Roles via a single REST API call, effectively promoting a low-privileged or newly self-registered account to administrator. It affects deployments running the all-Java user workflow adapter, or the Flowable adapter with a BPMN definition that does not require admin approval for self-registration or self-update, across versions 3.0.0-M0-3.0.16, 4.0.0-M0-4.0.6, and 4.1.0-M0-4.1.1. The Apache-issued advisory rates it CVSS 9.8; no public exploit identified at time of analysis and it is not on CISA KEV.
SQL injection in Apache Syncope allows an administrator holding sufficient entitlements to execute arbitrary SQL through stacked queries by abusing unsanitized sort parameters, affecting the 3.0.x, 4.0.x, and 4.1.x branches up to 3.0.16, 4.0.6, and 4.1.1 respectively. Because stacked queries are supported, an attacker can go beyond data theft to modify or destroy identity data and potentially chain to further backend compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; note the NVD CVSS 9.8 (PR:N) contradicts the vendor description, which explicitly requires an authenticated privileged administrator.
Remote code execution in Apache Syncope's connector subsystem allows an administrator holding sufficient entitlements to run arbitrary Groovy scripts through scripted REST and SQL connectors, escaping the intended sandbox and executing code on the host. It affects Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1, and is rooted in improper isolation (CWE-653) of the scripting engine. Although the published CVSS is 9.8, the vendor description states an authenticated privileged administrator is required, and there is no public exploit identified at time of analysis.
Remote code execution in Apache Syncope's workflow engine lets an administrator holding sufficient entitlements run arbitrary Groovy code on the server by importing and starting a malicious BPMN process definition through the REST API. Because Flowable's Groovy scriptTasks execute with no sandbox in affected 3.0.x, 4.0.x, and 4.1.x releases, script code embedded in the process runs directly with the privileges of the Syncope core JVM. No public exploit has been identified at time of analysis and the flaw is not in CISA KEV, but the trivial exploitation path once an entitled admin account is reached makes it a strong candidate for post-compromise abuse and insider misuse.
Groovy sandbox escape in Apache Syncope's Implementations feature lets an administrator holding Implementation entitlements author a malicious Groovy class that runs untrusted code outside the intended security sandbox, effectively achieving arbitrary code execution on the identity-management server. It affects Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the published CVSS of 9.8 overstates real-world exposure because the flaw requires a privileged administrator account.
Code execution via Groovy sandbox bypass in Apache Syncope 3.0 through 3.0.16, 4.0 through 4.0.5, and 4.1.0 allows a high-privileged administrator holding Implementations entitlements to run untrusted code outside the sandbox. By placing payload logic in a Groovy class static initializer, the attacker reaches a non-sandboxed execution path, yielding full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and EPSS is very low (0.02%, 6th percentile), consistent with a privilege-gated, not mass-scanned, issue.
Open redirect in Apache Syncope's SRA (Secure Remote Access) component allows unauthenticated network attackers to redirect authenticated users to attacker-controlled URLs during CAS SSO login flows. The vulnerability arises because Syncope SRA unconditionally trusts client-supplied forwarded HTTP headers (e.g. X-Forwarded-Host, X-Forwarded-Proto) when constructing the target Apereo CAS instance URL, enabling header-injection-based phishing attacks that can harvest credentials. Exploitation requires user interaction and the CAS authentication configuration to be active; no public exploit or active exploitation has been identified at time of analysis.
Sensitive information exposure in Apache Syncope allows a privileged administrator with Derived Schema entitlements to craft a malicious JEXL (Java Expression Language) expression that, when evaluated during User read operations, leaks LinkedAccount or Manager sensitive data - including hashed credentials - to any admin with User read access. Affected versions span three release lines: 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. No public exploit code has been identified and CISA has not listed this in KEV; exploitation requires high-privilege access, limiting real-world risk to insider threats or compromised admin accounts.
Cross-site scripting in Apache Syncope's Console and Enduser login pages allows unsanitized HTML and JavaScript to be rendered via a maliciously crafted notification message link. Versions 4.0.4 through 4.0.7 and 4.1.0-M0 through 4.1.2 are affected. An attacker who can deliver a crafted HTTP link to a Syncope user can execute arbitrary JavaScript in that user's browser upon visiting the login page, enabling session hijacking, credential theft, or UI redress attacks.
Malicious JEXL expression injection in Apache Syncope's Derived Schema feature enables privileged information disclosure across administrative roles. An administrator holding entitlements over Derived Schemas can embed a crafted JEXL expression that, when evaluated in the context of another administrator's User read operation, exposes security-sensitive User attributes that would not normally be accessible. Affected versions span three release lines (3.0.x through 3.0.16, 4.0.x through 4.0.5, and 4.1.0); no active exploitation is confirmed (no CISA KEV listing) and the EPSS score of 0.02% places this in the 4th percentile for exploitation probability.