{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-05T10:18:40.214","vulnerabilities":[{"cve":{"id":"CVE-2026-23795","sourceIdentifier":"security@apache.org","published":"2026-02-03T16:16:13.390","lastModified":"2026-02-06T14:43:16.790","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Restriction of XML External Entity Reference vulnerability in Apache Syncope Console.\nAn administrator with adequate entitlements to create or edit Keymaster parameters via Console can construct malicious XML text to launch an XXE attack, thereby causing sensitive data leakage occurs.\n\nThis issue affects Apache Syncope: from 3.0 through 3.0.15, from 4.0 through 4.0.3.\n\nUsers are recommended to upgrade to version 3.0.16 / 4.0.4, which fix this issue."},{"lang":"es","value":"Vulnerabilidad de restricción indebida de referencia a entidad externa XML en la Consola de Apache Syncope.\nUn administrador con los permisos adecuados para crear o editar parámetros de Keymaster a través de la Consola puede construir texto XML malicioso para lanzar un ataque XXE, causando así una fuga de datos sensibles.\n\nEste problema afecta a Apache Syncope: desde la 3.0 hasta la 3.0.15, desde la 4.0 hasta la 4.0.3.\n\nSe recomienda a los usuarios actualizar a la versión 3.0.16 / 4.0.4, que solucionan este problema."}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":3.6}]},"weaknesses":[{"source":"security@apache.org","type":"Primary","description":[{"lang":"en","value":"CWE-611"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:syncope:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0.0","versionEndExcluding":"3.0.16","matchCriteriaId":"E48D90FB-E49B-4FD5-B184-3049D3087635"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:syncope:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.4","matchCriteriaId":"877C8861-D17C-4BBE-A0C0-E3FDACB7CF9C"}]}]}],"references":[{"url":"https://lists.apache.org/thread/mzgbdn8hzk8vr94o660njcc7w62c2pos","source":"security@apache.org","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/02/02/2","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}}]}