PT-2026-6184 · Apache · Apache Syncope

Follycat + 1 · Published 2026-02-03 · Updated 2026-02-08 · CVE-2026-23795

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Syncope versions 3.0 through 3.0.15 Apache Syncope versions 4.0 through 4.0.3

Description An issue exists in Apache Syncope Console where an administrator with sufficient privileges to create or edit Keymaster parameters can construct malicious XML text to launch an XML External Entity (XXE) attack. This can lead to sensitive data leakage.

Recommendations Upgrade to Apache Syncope version 3.0.16 Upgrade to Apache Syncope version 4.0.4

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2026-23795

GHSA-73F3-RQQF-2J54

Affected Products

Apache Syncope

References · 17

• https://lists.apache.org/thread/mzgbdn8hzk8vr94o660njcc7w62c2pos · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23795 · Security Note
• https://osv.dev/vulnerability/GHSA-73f3-rqqf-2j54 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23795 · Vendor Advisory
• https://github.com/apache/syncope · Note
• https://reddit.com/r/VulnMatter/comments/1qvcyij/resumen_diario_de_vulnerabilidades_04022026 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1qvcw0u/resumen_diario_de_vulnerabilidades_04022026 · Reddit Post
• https://twitter.com/threatcluster/status/2018701087306346587 · Twitter Post
• https://twitter.com/CVEnew/status/2018724989470716080 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1qvcxbd/resumen_diario_de_vulnerabilidades_04022026 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1qvcre0/resumen_diario_de_vulnerabilidades_04022026 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1qvcq63/resumen_diario_de_vulnerabilidades_04022026 · Reddit Post
• https://twitter.com/oss_security/status/2020369314600378419 · Twitter Post
• http://openwall.com/lists/oss-security/2026/02/02/2 · Note
• https://twitter.com/NewsNerdie/status/2019312965258707219 · Twitter Post