CVE-2026-75015

Apache Syncope, an open-source identity management server, fails to properly mask sensitive values (such as nested secrets in cleartext) carried in the payloads of audit events before they are written to the configured audit store. The flaw is triggered during normal operation whenever audited operations include sensitive payload data, which is then persisted in readable form. This allows an administrator, or anyone else with access to the audit store, to view cleartext credentials they are not authorized to see — a privilege-boundary information exposure rather than a remotely exploitable flaw. All supported release lines are affected: 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. No CVSS score has been assigned yet, and there is no public proof of concept or known in-the-wild exploitation.

What to do: Upgrade to Apache Syncope 4.1.3, or 4.0.8 if you are on the 4.0 line; no fix is listed for the 3.0.x branch, so those deployments should move to a fixed 4.x release. Because secrets may already have been logged, inspect the configured audit store for cleartext sensitive values, purge or mask those records, and rotate any credentials that were captured. Restrict read access to the audit store to the minimum set of personnel while remediation is underway.