Executive brief
Apache Syncope is an open-source identity and access management platform used to manage user accounts and permissions across enterprise systems. When audit events are logged to a configured storage system, sensitive values like passwords and credentials are not properly masked, potentially exposing them to administrators with access to audit logs. An attacker or malicious administrator with access to the audit store could extract these sensitive credentials for unauthorized access to user accounts.
Technical details
This vulnerability is a credential exposure issue in Apache Syncope's audit logging mechanism. When audit events are persisted to a configured store, sensitive payload values are not sufficiently masked or redacted before storage. The vulnerability affects versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Attack vector is local/adjacent (requires administrative access to the audit store), and an attacker with audit log access can extract plaintext credentials. The fix is available in versions 4.0.8 and 4.1.3 where credential masking has been implemented.
Affected products
- Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, 4.1.0-M0 through 4.1.2
Timeline
- 2026-09-14: disclosed
- 2026-09-14: patched: Fixed in versions 4.0.8 and 4.1.3