CYBERSECURITYTRACKER
Permanent story citation

CVE-2026-78318: Apache Syncope: Unauthenticated reflected XSS in Console and Enduser

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 7279

As cited

Copy frozen at (site build).

vulnerabilities

CVE-2026-78318: Apache Syncope: Unauthenticated reflected XSS in Console and Enduser

CVE-2026-78318 is a moderate severity cross-site scripting (XSS) vulnerability in Apache Syncope affecting the Console and Enduser components. The flaw arises from improper input neutralization in notification messages and impacts versions 4.0.4 through 4.0.7 and 4.1.0-M0 through 4.1.2. An unauthenticated attacker can craft reflected XSS payloads to target users of affected Syncope instances.

Why it matters: Organizations running Apache Syncope 4.0.4 to 4.0.7 or 4.1.0-M0 to 4.1.2 must update to patch CVE-2026-78318; an unauthenticated XSS vector in the web interface poses risk to users and administrators managing identity data.

CVEsCVE-2026-78318
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary

Open in glossary