CVE-2026-62418 PUBLISHED

Apache Syncope: Low-privileged authenticated SSRF in Connectors and Resources check

Assigner: apache
Reserved: 14.07.2026 Published: 20.07.2026 Updated: 20.07.2026

Low-privileged authenticated Server-Side Request Forgery (SSRF) vulnerability in Apache Syncope via Connectors and Resources check.

This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1.

Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue.

Product Status

Vendor Apache Software Foundation
Product Apache Syncope
Versions Default: unaffected
  • affected from 3.0.0-M0 to 3.0.16 (incl.)
  • affected from 4.0.0-M0 to 4.0.6 (incl.)
  • affected from 4.1.0-M0 to 4.1.1 (incl.)

Credits

  • Adrián Leal Castaño finder

References

Problem Types

  • CWE-918 Server-Side Request Forgery (SSRF) CWE