CVE-2026-23795CWE-611

Apache Syncope: Console XXE on Keymaster parameters

Medium · published February 3, 2026

CVSS v3.1
4.9
EPSS
2%
Percentile
79.8
In the wild
Unconfirmed
What it is

Improper Restriction of XML External Entity Reference vulnerability in Apache Syncope Console.

An administrator with adequate entitlements to create or edit Keymaster parameters via Console can construct malicious XML text to launch an XXE attack, thereby causing sensitive data leakage occurs.

This issue affects Apache Syncope: from 3.0 through 3.0.15, from 4.0 through 4.0.3.

Users are recommended to upgrade to version 3.0.16 / 4.0.4, which fix this issue.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01925 · 79.8th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2026-02-03T15:14Z
EPSS history
Timeline
  • 03 FEB 15:14Z
    Apache Syncope: Console XXE on Keymaster parameters
    cvelistv5