{"id":"CVE-2026-78318","title":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Syncope.\n\n\n\nThe notification message, as optionally shown by Console's and Enduser's login pages can be instructed to display HT…","summary":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Syncope.\n\n\n\nThe notification message, as optionally shown by Console's and Enduser's login pages can be instructed to display HT…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"vendor":"Apache Software Foundation","product":"org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui","affected":["org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui >= 4.0.4 <= 4.0.7","org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui >= 4.1.0-M0 <= 4.1.2"],"published":"2026-09-14","updated":"2026-09-14","sourceUpdated":"2026-09-14T20:58:48.430","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-78318","references":[{"url":"https://lists.apache.org/thread/wmo15rczvd0w3ywjgqdrcznkb1v3qy9r","label":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/14/18","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-14T19:17:31.407723Z"},"ingestedAt":"2026-09-14T15:23:07.432Z","epss":0.00263,"epssPercentile":0.16148,"slug":"CVE-2026-78318","body":"## Overview\n\nImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Syncope.\n\n\n\nThe notification message, as optionally shown by Console's and Enduser's login pages can be instructed to display HTML tags with unsafe JS inline, via malicious HTTP link generation.\n\n\n\nThis issue affects Apache Syncope: from 4.0.4 through 4.0.7, from 4.1.0-M0 through 4.1.2.\n\n\n\nUsers are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":203264,"id":"CVE-2026-78318","ts":1789416900371,"field":"cvss","old":null,"new":"6.1"},{"seq":203263,"id":"CVE-2026-78318","ts":1789416900371,"field":"severity","old":"none","new":"medium"}]}