Apache Syncope CVE-2026-42797

Exploitation requires an attacker who holds - or can compromise - an administrator account with entitlements specifically scoped to Derived Schema management within Apache Syncope. A second entitlement set (User read access) is required to trigger schema evaluation and receive the exfiltrated data; these two roles may be held by the same actor or two colluding actors. The CVSS vector PR:H confirms high-privilege authentication is required, and AV:N confirms the attack is network-accessible (e.g., via the Syncope REST API or admin console). No user interaction beyond the schema creation and User read operation is needed (UI:N). Exploitation is limited by: (1) requirement for at least one high-privilege admin account, (2) the non-automatable nature of schema crafting (SSVC: Automatable: no), and (3) the attack targeting only the confidentiality of User security attributes, with no write or denial-of-service capability. Default-configuration deployments where admin roles are tightly segregated significantly reduce realistic risk.

The CVSS 3.1 score of 4.9 (Medium) reflects the high privilege requirement (PR:H) as the primary risk-limiting factor - network reachability (AV:N) and no user interaction (UI:N) add accessibility, but exploitation requires at least one administrator account with Derived Schemas entitlements. The confidentiality impact is rated High (C:H) with no integrity or availability impact (I:N/A:N), consistent with a pure information-disclosure class. EPSS at 0.02% (4th percentile) signals negligible real-world exploitation probability at the time of analysis. SSVC corroborates this: exploitation status is none, the attack is not automatable (requires deliberate schema crafting by a human actor), and technical impact is partial. No CISA KEV listing and no public proof-of-concept code have been identified. Taken together, these signals indicate this is a genuine but low-urgency issue - the primary real-world risk is insider threat or privilege-abuse scenarios where a rogue or compromised admin crafts a schema to exfiltrate sensitive user data covertly. The high-CVSS-but-moderate-real-risk characterization holds: defenders in environments with strict admin role segregation should prioritize patching, but this does not represent an imminent mass-exploitation threat.

A rogue or compromised administrator with Derived Schemas entitlements crafts a malicious JEXL expression embedded in a Derived Schema definition, designed to traverse and expose security-sensitive User attributes (such as hashed credentials, security questions, or token fields) when the schema is evaluated. A second administrator - or the same actor under a different role - subsequently performs a standard User read operation that triggers evaluation of the malicious schema, causing the sensitive data to be returned in the computed attribute output. No public proof-of-concept code has been identified, but the attack is conceptually straightforward for an actor already holding the prerequisite administrative entitlements.