Not rated
CVE-2026-62418 Low-privileged authenticated Server-Side Request Forgery (SSRF) vulnerability in Apache Syncope via Connectors and…
Description
Low-privileged authenticated Server-Side Request Forgery (SSRF) vulnerability in Apache Syncope via Connectors and Resources check. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Syncope 4.1 | 4.1.0-M0 → 4.1.1 | No fix stated |
| Apache Syncope 4.0 | 4.0.0-M0 → 4.0.6 | No fix stated |
| Apache Syncope 3.0 | 3.0.0-M0 → 3.0.16 | No fix stated |
Other CVEs of Apache Syncope
The 45 CVEs of Apache Syncope →
CVE-2026-114364
Apache Syncope: SQL injection via unsanitized opEvent in Audit Events search
Not rated
CVE-2026-113687
Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypass
Not rated
CVE-2026-113511
Apache Syncope: Delegated administration boundaries can be bypassed for Realm update
Not rated
CVE-2026-110535
Apache Syncope: AuthProfile value escalation via self-service update
Not rated