EUVD-2026-45959
GHSA-vqgw-p6qv-w77q
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor requires an entitled administrator, so PR:H (not NVD's PR:N); network-reachable admin UI and low complexity, with stacked queries yielding full C/I/A impact on the database.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
5DescriptionCVE.org
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope.
An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort parameters.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1.
Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue.
Articles & Coverage 2
AnalysisAI
SQL injection in Apache Syncope allows an administrator holding sufficient entitlements to execute arbitrary SQL through stacked queries by abusing unsanitized sort parameters, affecting the 3.0.x, 4.0.x, and 4.1.x branches up to 3.0.16, 4.0.6, and 4.1.1 respectively. Because stacked queries are supported, an attacker can go beyond data theft to modify or destroy identity data and potentially chain to further backend compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; note the NVD CVSS 9.8 (PR:N) contradicts the vendor description, which explicitly requires an authenticated privileged administrator.
Technical ContextAI
Apache Syncope is an open-source identity and access management (IAM) system for managing digital identities, provisioning, and governance in enterprise environments, backed by a relational database persistence layer (typically via JPA/OpenJPA). The flaw is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) where user-supplied 'sort' parameters used to order result sets are concatenated into SQL without proper neutralization. Because the underlying data access path permits stacked queries (multiple statements separated by semicolons), the injection is not limited to influencing a SELECT's ORDER BY clause - an attacker can append entirely separate INSERT/UPDATE/DELETE/DDL statements, dramatically increasing impact beyond typical read-only sort-column injection.
RemediationAI
Vendor-released patch: upgrade to Apache Syncope 4.0.7 or 4.1.2, which fix this issue; deployments on the 3.0.x branch should migrate to a fixed 4.0.7+ release since no fixed 3.0.x version is named in the advisory - confirm the 3.0.x upgrade path with Apache. Until upgrade, apply compensating controls: tightly restrict which accounts hold administrative entitlements (the exploit requires a privileged admin), audit and revoke unnecessary console/admin entitlements, and monitor database and application logs for anomalous multi-statement queries or unexpected DDL/DML originating from the Syncope service account. Where feasible, restrict the database account used by Syncope to the minimum required privileges and disable multi-statement (stacked query) support at the JDBC/driver level if the driver permits it, noting this may affect legitimate batch operations. Refer to the Apache advisory at https://lists.apache.org/thread/g0gpctj90pbczbjl5jr33t8gr1gltg8v for authoritative guidance.
More in Apache Syncope
View allPrivilege escalation in Apache Syncope's identity-management engine lets a self-service user grant themselves defined Ro
SQL injection in Apache Syncope's Task search endpoint allows an authenticated administrator to execute arbitrary SQL th
Server-Side Request Forgery in Apache Syncope lets a low-privileged authenticated user abuse the Connectors and Resource
Incorrect authorization in Apache Syncope's delegated administration module allows an authenticated delegated administra
OIDC client secret exposure in Apache Syncope enables any authenticated user to retrieve complete OIDC provider configur
Sensitive AES key material is written in plaintext to Apache Syncope application logs under a specific misconfiguration
CSV formula injection in Apache Syncope allows authenticated low-privilege users to embed spreadsheet formula payloads i
Code execution via Groovy sandbox bypass in Apache Syncope 3.0 through 3.0.16, 4.0 through 4.0.5, and 4.1.0 allows a hig
Remote code execution in Apache Syncope's connector subsystem allows an administrator holding sufficient entitlements to
Remote code execution in Apache Syncope's workflow engine lets an administrator holding sufficient entitlements run arbi
Groovy sandbox escape in Apache Syncope's Implementations feature lets an administrator holding Implementation entitleme
Broken delegated-administration authorization in Apache Syncope's Reconciliation service lets an authenticated administr
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today