Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitymedium

CVE-2026-78318: Apache Syncope: Unauthenticated reflected XSS in Console and Enduser

oss-security ()2 · 1 read
Read at seclists.org
AI summary · glm-5.3Summaries by Vani AI

Apache Syncope Console and Enduser UIs suffer unauthenticated reflected XSS via notification messages, affecting versions 4.0.4 through 4.1.2.

CVE-2026-78318 is a moderate-severity cross-site scripting flaw in Apache Syncope's syncope-client-idrepo-common-ui module. The notification message, optionally shown by the Console and Enduser UIs, is improperly neutralized, enabling unauthenticated reflected XSS. Affected versions are 4.0.4 through 4.0.7 and 4.1.0-M0 through 4.1.2; no exploitation is reported.

Key facts
  • Unauthenticated reflected XSS in Console and Enduser UIs
  • Triggered via improperly sanitized notification message
  • Affects only 4.0.4-4.0.7 and 4.1.0-M0-4.1.2
Analyze CVE-2026-78318 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-78318
Tags
apacheconsolecve-2026-78318enduserreflected-xsssyncopexss

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-78318
Unauthenticated Reflected XSS in Apache Syncope Console and Enduser Login Pages
6.1—

From the original article

Posted by Francesco Chicchiriccò on Sep 14 Severity: moderate Affected versions: - Apache Syncope (org. apache. syncope.

oss-security

seclists.org

Read the full article at oss-security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.