CVE-2026-78318 is a vulnerability in Apache Syncope
Published on September 14, 2026
Apache Syncope: Unauthenticated reflected XSS in Console and Enduser
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Syncope.
The notification message, as optionally shown by Console's and Enduser's login pages can be instructed to display HTML tags with unsafe JS inline, via malicious HTTP link generation.
This issue affects Apache Syncope: from 4.0.4 through 4.0.7, from 4.1.0-M0 through 4.1.2.
Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
Vulnerability Analysis
CVE-2026-78318 is exploitable with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.
Weakness Type
What is a XSS Vulnerability?
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVE-2026-78318 has been classified to as a XSS vulnerability or weakness.
Products Associated with CVE-2026-78318
Want to know whenever a new CVE is published for Apache Syncope? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache Syncope:- Version 4.0.4, <= 4.0.7 is affected.
- Version 4.1.0-M0, <= 4.1.2 is affected.