{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-75015", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-08-17T13:08:21.241Z", "datePublished": "2026-09-14T12:55:27.674Z", "dateUpdated": "2026-09-14T19:26:59.920Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-09-14T12:55:27.674Z"}, "title": "Apache Syncope: Nested secrets leak cleartext into audit records readable", "problemTypes": [{"descriptions": [{"description": "CWE-522 Insufficiently Protected Credentials", "lang": "en", "cweId": "CWE-522", "type": "CWE"}]}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Syncope", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.syncope.core:syncope-core-provisioning-java", "packageURL": "pkg:maven/org.apache.syncope.core/syncope-core-provisioning-java", "versions": [{"status": "affected", "version": "3.0.0-M0", "lessThanOrEqual": "3.0.16", "versionType": "semver"}, {"status": "affected", "version": "4.0.0-M0", "lessThanOrEqual": "4.0.7", "versionType": "semver"}, {"status": "affected", "version": "4.1.0-M0", "lessThanOrEqual": "4.1.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"value": "Insufficiently Protected Credentials vulnerability in Apache Syncope.\n\nAudit events, when sent to the configured store, are not sufficiently masked for the sensitive values they might carry on their payloads, thus allowing administrators to access such sensitive values.\n\n\n\n\n\nThis issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2.\n\n\nUsers are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Insufficiently Protected Credentials vulnerability in Apache Syncope.<br><br>Audit events, when sent to the configured store, are not sufficiently masked for the sensitive values they might carry on their payloads, thus allowing administrators to access such sensitive values.</p><p></p><div>This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2.</div><br><div>Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.</div><p></p>"}]}], "references": [{"url": "https://lists.apache.org/thread/nns7711kyomy28r7rh2pps06ymd5s99k", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "n0mi1k", "type": "finder"}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/09/14/12"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-09-14T18:09:09.565Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-09-14T19:26:29.295519Z", "id": "CVE-2026-75015", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-14T19:26:59.920Z"}}]}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.syncope.core:syncope-core-provisioning-java", "packageURL": "pkg:maven/org.apache.syncope.core/syncope-core-provisioning-java", "product": "Apache Syncope", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "3.0.16", "status": "affected", "version": "3.0.0-M0", "versionType": "semver"}, {"lessThanOrEqual": "4.0.7", "status": "affected", "version": "4.0.0-M0", "versionType": "semver"}, {"lessThanOrEqual": "4.1.2", "status": "affected", "version": "4.1.0-M0", "versionType": "semver"}]}], "source": "security@apache.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Insufficiently Protected Credentials vulnerability in Apache Syncope.\n\nAudit events, when sent to the configured store, are not sufficiently masked for the sensitive values they might carry on their payloads, thus allowing administrators to access such sensitive values.\n\n\n\n\n\nThis issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2.\n\n\nUsers are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue."}], "id": "CVE-2026-75015", "lastModified": "2026-09-14T20:58:48.430", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-75015", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-14T19:26:29.295519Z", "version": "2.0.3"}}]}, "published": "2026-09-14T13:18:45.860", "references": [{"source": "security@apache.org", "url": "https://lists.apache.org/thread/nns7711kyomy28r7rh2pps06ymd5s99k"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/09/14/12"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-522"}], "source": "security@apache.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0-M0,3.0.16]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0-M0,4.0.7]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.1.0-M0,4.1.2]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache Syncope", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "syncope", "vendor": "apache"}], "created": "2026-09-14T15:00:03.691970+00:00", "updated": "2026-09-14T15:00:03.692016+00:00", "vendors": ["apache", "apache$PRODUCT$syncope"]}