https://seclists.org/oss-sec/2026/q3/768: CVE-2026-78318: Apache Syncope: Unauthenticated flected XSS in Console and Enduser

Q: Which deployments are exposed to this issue?

Deployments using the affected Apache Syncope common UI artifact and exposing the Console or Enduser login pages are relevant. The issue involves the optional notification message displayed on those login pages.

Q: What does an attacker need to exploit the vulnerability?

An attacker needs to generate a malicious HTTP link that causes the login-page notification message to render HTML containing unsafe inline JavaScript. The issue is described as unauthenticated, so no prior login is required.

Q: What should teams do if they are running an affected release?

Upgrade Apache Syncope to version 4.0.8 or 4.1.3. These versions are identified as fixing the issue.

Published Sep 14, 2026

Updated

Affected Software

2 affected components

Apache Syncope>=4.0.4<=4.0.7

Apache Syncope>=4.1.0-M0<=4.1.2

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using the affected Apache Syncope common UI artifact and exposing the Console or Enduser login pages are relevant. The issue involves the optional notification message displayed on those login pages.

What does an attacker need to exploit the vulnerability?

An attacker needs to generate a malicious HTTP link that causes the login-page notification message to render HTML containing unsafe inline JavaScript. The issue is described as unauthenticated, so no prior login is required.

What should teams do if they are running an affected release?

Upgrade Apache Syncope to version 4.0.8 or 4.1.3. These versions are identified as fixing the issue.