SQL injection in Apache Syncope Audit Events search (CVE-2026-57308)

Apache Syncope contains an SQL injection vulnerability in its Audit Events search functionality. An administrator with adequate entitlements can execute arbitrary SQL via stacked queries by leveraging unsanitized sort parameters. This poses a risk of unauthorized data access or manipulation within the database. Affected versions: - Apache Syncope 3.0.0-M0 through 3.0.16 - Apache Syncope 4.0.0-M0 through 4.0.6 - Apache Syncope 4.1.0-M0 through 4.1.1 We recommend updating to: 4.0.7, 4.1.2. CVSS ? · our assessment: this_week Reference: https://lists.apache.org/thread/g0gpctj90pbczbjl5jr33t8gr1gltg8v Details: https://vuln.today/cve/CVE-2026-57308