CVSS 3.1
6.8 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:NCVE-2026-23794
Medium (6.8) in apache syncope. EPSS 0.5% chance of exploitation in the next 30 days. Fixed in org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui 3.0.16, 4.0.4.
Reflected XSS in Apache Syncope's Enduser Login page.
An attacker that tricks a legitimate user into clicking a malicious link and logging in to Syncope Enduser could steal that user's credentials.
This issue affects Apache Syncope: from 3.0 through 3.0.15, from 4.0 through 4.0.3.
Users are recommended to upgrade to version 3.0.16 / 4.0.4, which fix this issue.
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 44% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:syncope
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-v84m-gfw5-hm2w | Maven | org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui | >=3.0.0 <3.0.16 | 3.0.16 |
| GHSA-v84m-gfw5-hm2w | Maven | org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui | >=4.0.0 <4.0.4 | 4.0.4 |