PT-2026-6184 · Apache · Apache Syncope

Follycat + 1 · Publicado 2026-02-03 · Atualizado 2026-02-08 · CVE-2026-23795

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Syncope versions 3.0 through 3.0.15 Apache Syncope versions 4.0 through 4.0.3

Description An issue exists in Apache Syncope Console where an administrator with sufficient privileges to create or edit Keymaster parameters can construct malicious XML text to launch an XML External Entity (XXE) attack. This can lead to sensitive data leakage.

Recommendations Upgrade to Apache Syncope version 3.0.16 Upgrade to Apache Syncope version 4.0.4

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2026-23795

GHSA-73F3-RQQF-2J54

Produtos afetados

Apache Syncope

Referências · 17

• https://github.com/apache/syncope · Nota
• https://lists.apache.org/thread/mzgbdn8hzk8vr94o660njcc7w62c2pos · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-23795 · Nota de Segurança
• https://reddit.com/r/VulnMatter/comments/1qvcyij/resumen_diario_de_vulnerabilidades_04022026 · Publicação no Reddit
• https://osv.dev/vulnerability/GHSA-73f3-rqqf-2j54 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-23795 · Aviso do Fabricante
• https://reddit.com/r/VulnMatter/comments/1qvcw0u/resumen_diario_de_vulnerabilidades_04022026 · Publicação no Reddit
• https://twitter.com/threatcluster/status/2018701087306346587 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2018724989470716080 · Publicação no Twitter
• https://reddit.com/r/VulnMatter/comments/1qvcxbd/resumen_diario_de_vulnerabilidades_04022026 · Publicação no Reddit
• https://reddit.com/r/VulnMatter/comments/1qvcre0/resumen_diario_de_vulnerabilidades_04022026 · Publicação no Reddit
• https://reddit.com/r/VulnMatter/comments/1qvcq63/resumen_diario_de_vulnerabilidades_04022026 · Publicação no Reddit
• https://twitter.com/oss_security/status/2020369314600378419 · Publicação no Twitter
• http://openwall.com/lists/oss-security/2026/02/02/2 · Nota
• https://twitter.com/NewsNerdie/status/2019312965258707219 · Publicação no Twitter