VulnSocial

CVE-2026-23794General(apache / syncope)

LOWCVSS 6.8 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Reflected XSS in Apache Syncope's Enduser Login page. An attacker that tricks a legitimate user into clicking a malicious link and logging in to Syncope Enduser could steal that user's credentials. This issue affects Apache Syncope: from 3.0 through 3.0.15, from 4.0 through 4.0.3. Users are recommended to upgrade to version 3.0.16 / 4.0.4, which fix this issue.

apache CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • syncope

Threat summary

  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • General: 2 classified signals
  • Disclosure: 1 classified signal
  • Peaked 2d ago at 1 mentions (2026-02-02); latest day: 1
  • 3 total mentions across 3 days

Affected systems

Vendors
apache
Products
syncope

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-02-02: 1Mentions · 2026-02-03: 1Mentions · 2026-02-08: 1Technical Details · 2026-02-03: 1Technical Details · 2026-02-08: 102-0202-0302-08
Signal classification2 categories
General
266.7%
Disclosure
133.3%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-02-021
General1
2026-02-031
Disclosure1
2026-02-081
General1
Full discourse3 posts
  • Open Source Security mailing list@oss_security
    General

    CVE-2026-23794: Apache Syncope: Reflected XSS on Enduser Login https://www.openwall.com/lists/oss-security/2026/02/02/1 CVE-2026-23795: Apache Syncope: Console XXE on Keymaster parameters https://www.openwall.com/lists/oss-security/2026/02/02/2

    Post summary

    The post lists two new Apache Syncope CVEs with brief vulnerability types—Reflected XSS and XXE—but offers no PoC, exploit, patch, or evidence of active exploitation.

    00030374
    4.4K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-23794 Reflected XSS in Apache Syncope's Enduser Login page. An attacker that tricks a legitimate user into clicking a malicious link and logging in to Syncope Enduser could… https://www.cve.org/CVERecord?id=CVE-2026-23794

    Post summary

    CVE-2026-23794 is a reflected XSS vulnerability affecting Apache Syncope's Enduser login page; no exploit or patch details are provided.

    00010242
    56.5K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2026-23794 CVE-2026-23794 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-23794

    Post summary

    The post merely references CVE-2026-23794 and links to a Vulmon page, providing no substantive details or context.

    0000075
    4.0K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appapachesyncope---

Explore more

Back to dashboardapache CVEssyncope vulnerabilities