CVE-2026-23795

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

Improper Restriction of XML External Entity Reference vulnerability in Apache Syncope Console. An administrator with adequate entitlements to create or edit Keymaster parameters via Console can construct malicious XML text to launch an XXE attack, thereby causing sensitive data leakage occurs.

This issue affects Apache Syncope: from 3.0 through 3.0.15, from 4.0 through 4.0.3.

Users are recommended to upgrade to version 3.0.16 / 4.0.4, which fix this issue.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Syncope	>= 3.0, <= 3.0.15; >= 4.0, <= 4.0.3

References

https://lists.apache.org/thread/mzgbdn8hzk8vr94o660njcc7w62c2posMailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/02/02/2Mailing List, Third Party Advisory

Timeline

Published: Feb 3, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-237969.8Quick.Cart allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authenticat CVE-2026-237974.9In Quick.Cart user passwords are stored in plaintext form. An attacker with high privileges can display users' password in user editing page CVE-2026-237988.8Deserialization of Untrusted Data vulnerability in blubrry PowerPress Podcasting powerpress allows Object Injection.This issue affects Power CVE-2026-237996.5Missing Authorization vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This CVE-2026-23807.4On affected platforms running Arista EOS with OpenConfig-related services (i.e., gNMI, gNSI, RESTCONF and NETCONF), sensitive requests and r CVE-2026-2380010.0Incorrect Privilege Assignment vulnerability in Modular DS modular-connector allows Privilege Escalation.This issue affects Modular DS: from CVE-2026-238018.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in fuelthemes The Issu CVE-2026-238029.1Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine ai-engine allows Using Malicious Files.This issue affe CVE-2026-238036.4Server-Side Request Forgery (SSRF) vulnerability in Burhan Nasir Smart Auto Upload Images smart-auto-upload-images allows Server Side Reques CVE-2026-238045.4Missing Authorization vulnerability in BBR Plugins Better Business Reviews better-business-reviews allows Exploiting Incorrectly Configured CVE-2026-238057.6Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yoren Chang Media Search Enhanced medi CVE-2026-238067.5Missing Authorization vulnerability in BlueGlass Interactive AG Jobs for WordPress job-postings allows Exploiting Incorrectly Configured Acc