CVE-2026-62418
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
An authenticated Server-Side Request Forgery (SSRF) vulnerability with low privileges was found in Apache Syncope via Connectors and Resources check. It allows an attacker to send requests from the server to internal systems.
Risk Assessment
The risk involves potential scanning of the internal network, access to sensitive data or services not exposed externally, which could lead to attack escalation.
Recommendation
It is recommended to immediately upgrade Apache Syncope to version 4.0.7 or 4.1.2, which contain the fix for this vulnerability.
Other vulnerabilities in Apache Syncope
See all- CVE-2026-63071Critical
An Improper Isolation or Compartmentalization vulnerability in Apache Syncope allows an administrator with adequate entitlements to create a malicious Groovy class containing untrusted code, bypassing the Groovy security sandbox.
- CVE-2026-62183Critical
An improper privilege management vulnerability exists in Apache Syncope. A user can exploit a REST API call to grant themselves administrative roles, gaining full control over the system. Affected versions: 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1.
- CVE-2026-57308Critical
An SQL Injection vulnerability in Apache Syncope allows an administrator with adequate entitlements to execute arbitrary SQL via stacked queries using unsanitized sort parameters. Affected versions: 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1.
- CVE-2026-53421Critical
An improper isolation or compartmentalization vulnerability exists in Apache Syncope. An administrator with adequate entitlements can achieve remote code execution through the connector subsystem by relying on scripted connectors (REST and SQL) to run Groovy scripts.
- CVE-2026-53405Critical
A vulnerability in Apache Syncope allows improper isolation of Groovy scripts in BPMN processes. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and start them, causing the Groovy script to execute directly on the server without a sandbox.
- CVE-2026-42797Medium
Apache Syncope versions 3.0 to 3.0.16, 4.0 to 4.0.5, and 4.1.0 have a sensitive information disclosure vulnerability via malicious JEXL expressions in Derived Schemas. An administrator with sufficient entitlements can access user-related security-sensitive information.
- CVE-2026-42782High
Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can create a malicious Groovy class containing untrusted code reaching a non-sandboxed execution path via the class static initializer. This affects versions 3.0 through 3.0.16, 4.0 through 4.0.5, and 4.1.0. Fixed in 4.0.6 and 4.1.1.
Original NVD description (English source)
Low-privileged authenticated Server-Side Request Forgery (SSRF) vulnerability in Apache Syncope via Connectors and Resources check. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue.