Loading story…
Apache released security updates for its Syncope identity and access management platform to fix multiple vulnerabilities across the 3.0, 4.0, and 4.1 branches, including remote code execution, SQL injection, privilege escalation, SSRF, information disclosure, XXE, XSS, and cryptographic weaknesses. The most severe issues include several Groovy-related post-authentication RCE flaws, while CVE-2026-57308 affects Audit Events search through an unsanitized sort parameter that can enable authenticated SQL injection, and CVE-2026-62183 can let a regular user elevate privileges through certain self-service workflow configurations and obtain administrator-level entitlements.
Affected releases include Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1 for the newly disclosed SQL injection and privilege escalation bugs, with Apache delivering fixes in versions 4.0.7 and 4.1.2 and noting that some older flaws were addressed in earlier point releases such as 4.1.1, 4.0.6, 4.0.4, 4.0.3, 3.0.16, and 3.0.15. Apache said binary hotfixes are not available, requiring organizations to upgrade or rebuild from patched source, and urged administrators to review roles, entitlements, and self-service workflows; no public exploitation has been confirmed.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Apache reported additional Syncope fixes covering remote code execution, SSRF, information disclosure, XXE, XSS, and cryptographic weaknesses, alongside the SQL injection and privilege escalation issues. The advisory said users must upgrade or rebuild from patched source because binary hotfixes are not provided.
Apache Syncope patched an authenticated SQL injection flaw in Audit Events search (CVE-2026-57308) and a self-service privilege escalation flaw (CVE-2026-62183). The fixes were released in Syncope versions 4.0.7 and 4.1.2, affecting 3.0, 4.0, and 4.1 branches.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesecurityonline.info
Open sourcesyncope.apache.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Apache Software Foundation released security updates for *Apache Syncope* to address vulnerabilities that could enable **session hijacking** and **sensitive data exposure** in identity-management deployments. One issue, **CVE-2026-23794**, is a **reflected XSS** flaw in the **Enduser Login** page where an attacker can trick a user into clicking a crafted link, leading to arbitrary JavaScript execution in the victim’s browser and potential theft of session cookies or actions performed as the user. A second issue, **CVE-2026-23795**, is an **XML External Entity (XXE)** vulnerability in the **Syncope Console** related to creating/editing **Keymaster parameters**; it requires an attacker to have (or obtain) administrator-level entitlements, but can then be used to submit malicious XML to trigger data leakage and potentially facilitate session compromise. Reported affected versions include **3.0–3.0.15** and **4.0–4.0.3**, with fixes available in **3.0.16** and **4.0.4**; organizations running impacted releases are advised to upgrade promptly, particularly given Syncope’s role in authentication and access control.
Jun 29, 2026
Apache Syncope disclosed **CVE-2026-57308**, an important SQL injection vulnerability in the Audit Events search functionality that can let an authenticated administrator with sufficient entitlements execute arbitrary SQL through stacked queries. The issue is caused by improper neutralization of special elements in SQL commands, specifically unsanitized `sort` parameters handled by the application. The vulnerability affects Apache Syncope versions `3.0.0-M0` through `3.0.16`, `4.0.0-M0` through `4.0.6`, and `4.1.0-M0` through `4.1.1`. Apache advised users to upgrade to **4.0.7** or **4.1.2** to remediate the flaw, and credited **Lennart Hostettler** with reporting the issue.
Jul 20, 2026
The Apache Software Foundation released security updates for **Apache CXF** to fix three newly disclosed vulnerabilities affecting enterprise deployments of the services framework. The flaws include **`CVE-2026-44930`**, an LDAP injection issue in the XKMS LDAP certificate repository that can let attackers manipulate backend search filters and retrieve arbitrary digital certificates, potentially enabling impersonation, interception of encrypted communications, and lateral movement. Apache also addressed an **XXE** flaw in WS-Transfer caused by insecure XML parser configuration, which could expose sensitive files and support internal network mapping, as well as a possible **remote code execution** condition tied to an incomplete fix for an older JMS-related bug. Affected releases include **4.2.0**, **4.0.0 through 4.1.5**, and older branches before **3.6.11**. Apache published patched versions **4.2.1**, **4.1.6**, and **3.6.11**, and guidance urges organizations to upgrade immediately, review LDAP access controls, monitor certificate access activity, and reduce exposure of XKMS components where possible. The disclosures indicate that while the LDAP flaw does not itself provide code execution, the combined set of weaknesses could materially affect trust infrastructure and server security in vulnerable environments.
Jun 29, 2026