CVE-2026-62418: Apache Syncope: Low-privileged authenticated SSRF in Connectors and Resources check
Low-privileged authenticated Server-Side Request Forgery (SSRF) vulnerability in Apache Syncope via Connectors and Resources check.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1.
Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Syncopeto a version that resolves this vulnerability.Fixed in 4.0.7 - Upgrade
Upgrade
Apache Syncopeto a version that resolves this vulnerability.Fixed in 4.1.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-62418?
The severity of CVE-2026-62418 is high, with a CVSS score of 8.1.
What is the impact of CVE-2026-62418?
CVE-2026-62418 allows low-privileged authenticated users to perform Server-Side Request Forgery (SSRF) attacks.
How do I fix CVE-2026-62418?
To mitigate CVE-2026-62418, users should upgrade to Apache Syncope version 4.1.2 or later.
Which versions of Apache Syncope are affected by CVE-2026-62418?
CVE-2026-62418 affects Apache Syncope versions from 3.0.0-M0 through 3.0.16 and 4.0.0-M0 through 4.0.6.
How can I verify if my Apache Syncope installation is vulnerable to CVE-2026-62418?
You can determine if your Apache Syncope installation is vulnerable by checking if you are running a version between the affected ranges mentioned in the vulnerability description.