GitHub Advisoryadvisory · Maven

GHSA-73f3-rqqf-2j54 Apache Syncope: Console XXE on Keymaster parameters

MEDIUM Published 2026-02-03 Modified 2026-02-03 Official page ↗
Aliases
CVE-2026-23795
Ecosystem
Maven
Packages
org.apache.syncope.client.idrepo:syncope-client-idrepo-console
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-611
Reviewed
2026-02-03

Affected packages

• Maven org.apache.syncope.client.idrepo:syncope-client-idrepo-console: >= 3.0.0, < 3.0.16 → fixed in 3.0.16 • Maven org.apache.syncope.client.idrepo:syncope-client-idrepo-console: >= 4.0.0, < 4.0.4 → fixed in 4.0.4

Description

Improper Restriction of XML External Entity Reference vulnerability in Apache Syncope Console. An administrator with adequate entitlements to create or edit Keymaster parameters via Console can construct malicious XML text to launch an XXE attack, thereby causing sensitive data leakage occurs. This issue affects Apache Syncope: from 3.0 through 3.0.15, from 4.0 through 4.0.3. Users are recommended to upgrade to version 3.0.16 / 4.0.4, which fix this issue.

Related

Alias · CVE (1)

  • CVE-2026-23795 Improper Restriction of XML External Entity Reference vulnerability in Apache Syncope Console. vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References