Volerion logoVolerion
Volerion logoVolerion

Apache Syncope Server-Side Request Forgery Vulnerability in Connectors and Resources Check

Vulnerability

A low-privileged authenticated Server-Side Request Forgery (SSRF) vulnerability has been identified in Apache Syncope. This issue arises in the Connectors and Resources check, allowing for potential manipulation of server-side requests. The vulnerability affects Apache Syncope versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1.

Impact

Exploitation of this vulnerability allows for Server-Side Request Forgery, where an authenticated user can make the server send requests on their behalf. This could potentially be used to access internal services or resources that are not normally exposed to the user.

Remediation

Users are advised to upgrade to Apache Syncope versions 4.0.7 or 4.1.2, which address this vulnerability.

Added: Jul 20, 2026, 3:28 PM
Updated: Jul 20, 2026, 3:28 PM

Vulnerability Rating

Custom Algorithm
spread
0.0
impact
0.6
exploitability
4.7
remediation
0.0
relevance
10.0
threat
0.0
urgency
2.9
incentive
0.0

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.