CVE-2026-75015
Last modified
CVE-2026-75015 is a medium-severity vulnerability rated 4.9/10 on the CVSS scale. Insufficiently Protected Credentials vulnerability in Apache Syncope. Audit events, when sent to the configured store, are not sufficiently masked for the sensitive values they might carry on their payloads, thus allowing administrators to access such sensitive values. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue..
Description
Insufficiently Protected Credentials vulnerability in Apache Syncope. Audit events, when sent to the configured store, are not sufficiently masked for the sensitive values they might carry on their payloads, thus allowing administrators to access such sensitive values. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Syncope | >= 3.0.0-M0, <= 3.0.16; >= 4.0.0-M0, <= 4.0.7; >= 4.1.0-M0, <= 4.1.2 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-75015?
How severe is CVE-2026-75015?
How do I fix CVE-2026-75015?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-7501A weakness has been identified in LinkStackOrg LinkStack up …3.5
- CVE-2026-75010In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, t…4.3
- CVE-2026-75011A flaw has been found in kylecui NetForensicMCP 2.1.0. Impac…6.3
- CVE-2026-75012A security vulnerability has been detected in TOTOLINK EX120…6.5
- CVE-2026-75013A vulnerability was detected in TOTOLINK EX1200L 9.3.5u.6146…6.5
- CVE-2026-75014A flaw has been found in SourceCodester Pet Grooming Managem…7.3
- CVE-2026-75016The Magazine Blocks plugin for WordPress is vulnerable to St…6.4
- CVE-2026-75017The Magazine Blocks – Blog Designer, Magazine & Newspaper We…4.3
- CVE-2026-75018The Custom Contact Forms plugin for WordPress is vulnerable …4.3
- CVE-2026-75019The Cozy Blocks – Page Builder for Gutenberg Editor & FSE wi…6.4
- CVE-2026-7502A security vulnerability has been detected in LinkStackOrg L…5.4
- CVE-2026-75020Improper Neutralization of Special Elements used in an LDAP …8.1
Are you affected by CVE-2026-75015?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST