{"id":"CVE-2026-75015","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-75015","generatedAt":"2026-10-28T00:52:39.325Z","title":"Insufficiently Protected Credentials vulnerability in Apache Syncope.","description":"Insufficiently Protected Credentials vulnerability in Apache Syncope.\n\nAudit events, when sent to the configured store, are not sufficiently masked for the sensitive values they might carry on their payloads, thus allowing administrators to access such sensitive values.\n\n\n\n\n\nThis issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2.\n\n\nUsers are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.","published":"2026-09-14T13:18:46.000Z","lastModified":"2026-09-14T20:58:48.000Z","status":"Deferred","sourceIdentifier":"security@apache.org","cvss":{"version":"3.1","score":4.9,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"},"cwe":["CWE-522"],"affected":[],"epss":{"score":0.00391,"percentile":0.33023,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.39%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://lists.apache.org/thread/nns7711kyomy28r7rh2pps06ymd5s99k","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/14/12","source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-75015","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}