CVE-2026-75015 — Apache Syncope: Nested secrets leak cleartext into audit records readable
Insufficiently Protected Credentials vulnerability in Apache Syncope. Audit events, when sent to the configured store, are not sufficiently masked for the sensitive values they…
Published: 2026-09-14 · CVSS: 4.9 · CVSS 3.1
Insufficiently Protected Credentials vulnerability in Apache Syncope. Audit events, when sent to the configured store, are not sufficiently masked for the sensitive values they might carry on their payloads, thus allowing administrators to access such sensitive values. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7