Apache Syncope servers allow administrators with sufficient permissions to create or edit Keymaster parameters via the console. By supplying crafted XML containing external entity references, these administrators can trigger XML External Entity (XXE) processing, which may expose internal files, environment data, or other sensitive information. The vulnerability is classified as CWE-611 and can lead to the unintended disclosure of confidential data to an attacker who can control the XML input.

The affected product is Apache Syncope, version 3.0.0 through 3.0.15 and 4.0.0 through 4.0.3. Affected installations expose a web console that accepts XML for Keymaster configuration. All builds in these ranges are vulnerable until the next patch version; upgrading to 3.0.16 or 4.0.4 (or later) addresses the issue.

The vulnerability carries a CVSS score of 4.9, indicating moderate severity. The EPSS score is less than 1%, which means exploitation is considered unlikely under current threat intelligence. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated administrator with the ability to edit Keymaster parameters; the attacker would need access to the console or privileged credentials. While the impact is limited to data leakage rather than full system compromise, it can expose critical configuration or sensitive user information, warranting prompt remediation.