CVE-2026-23795
Medium · 4.9CVSS
4.9
EPSS
1.9%
Published
Feb 3, 2026
CISA due date
—
The record
Improper Restriction of XML External Entity Reference vulnerability in Apache Syncope Console. An administrator with adequate entitlements to create or edit Keymaster parameters via Console can construct malicious XML text to launch an XXE attack, thereby causing sensitive data leakage occurs. This issue affects Apache Syncope: from 3.0 through 3.0.15, from 4.0 through 4.0.3. Users are recommended to upgrade to version 3.0.16 / 4.0.4, which fix this issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.syncope.client.idrepo:syncope-client-idrepo-console | 3.0.0 | 3.0.16 |
| Maven | org.apache.syncope.client.idrepo:syncope-client-idrepo-console | 4.0.0 | 4.0.4 |
Related vulnerabilities
- GHSA-73f3-rqqf-2j54 Apache Syncope: Console XXE on Keymaster parameters Same vulnerability
- CVE-2026-89260 MoguBlog through 6.2 contains an XML external entity injection vulnerability in the… CWE-611
- CVE-2026-84941 An information disclosure vulnerability in the SAML Single Sign-On (SSO) functionality of… CWE-611
- CVE-2026-79572 An XXE (XML External Entity) vulnerability in the level-rule module of Distribution… CWE-611
- CVE-2026-19614 The API is prone to XML external entity (XXE) injection. CWE-611
- CVE-2026-71375 Improper restriction of XML external entity reference vulnerability in Cosminexus… CWE-611
- CVE-2026-76958 SAP Integration Suite does not sufficiently validate XML documents accepted from… CWE-611
- CVE-2026-17444 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and… CWE-611