CVE-2026-62418: syncope from 3.0.0 (inclusive), through 3.0.16 (inclusive), from 4.0.0 (inclusive), before 4.0.7 (exclusive), from…

Affected technology

syncope · from 3.0.0 (inclusive), through 3.0.16 (inclusive)
apache

syncope · from 4.0.0 (inclusive), before 4.0.7 (exclusive)
apache

syncope · from 4.1.0 (inclusive), before 4.1.2 (exclusive)
apache

Apache Syncope · 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, 4.1.0-M0 through 4.1.1
Apache Software Foundation

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Source advisory’s CVSS 3.1 assessment (base score 8.1/10) rates confidentiality and integrity impact as high; availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.