EUVD-2026-45959
GHSA-vqgw-p6qv-w77q
Severity by source
Network-reachable admin endpoint (AV:N) with straightforward injection (AC:L), but requires an entitled administrator (PR:H); stacked SQL enables full read/write/destroy of the IAM store (C/I/A:H).
Primary rating from Vendor (apache).
Lifecycle Timeline
2DescriptionCVE.org
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope.
An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort parameters.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1.
Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue.
Articles & Coverage 2
AnalysisAI
SQL injection in Apache Syncope's administrative sort-parameter handling lets a privileged administrator execute arbitrary SQL via stacked queries against the underlying identity-management datastore. The flaw (CWE-89) affects 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1, and is fixed in 4.0.7 / 4.1.2. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Apache Syncope administrator who already holds 'adequate entitlements' to reach the affected search/sort functionality - this admin-privilege prerequisite is the primary limiting factor and rules out anonymous or low-privileged users. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | No vendor CVSS vector, EPSS score, KEV entry, or SSVC decision was provided, so real-world risk must be inferred from the description. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A malicious or compromised Syncope administrator with the required entitlements submits a crafted 'sort' parameter to a search/list endpoint; the value is concatenated into a SQL ORDER BY clause and, via stacked queries, appends additional statements such as INSERT/UPDATE/DROP that the database executes. With this an insider could grant themselves elevated identity attributes, exfiltrate credential/identity data, or corrupt the IAM datastore. … |
| Remediation | Vendor-released patch: upgrade to Apache Syncope 4.0.7 or 4.1.2, which remediate the unsanitized sort-parameter handling, as recommended in the Apache advisory at https://lists.apache.org/thread/g0gpctj90pbczbjl5jr33t8gr1gltg8v. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Apache Syncope installations and identify those running affected versions (3.0.0-3.0.16, 4.0.0-4.0.6, 4.1.0-4.1.1). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Syncope
View allMalicious JEXL expression injection in Apache Syncope's Derived Schema feature enables privileged information disclosure
Server-Side Request Forgery in Apache Syncope's Connectors and Resources check endpoint allows low-privileged authentica
Privilege escalation in Apache Syncope's identity management engine allows a user to grant themselves defined Roles thro
Remote code execution in Apache Syncope allows an authenticated administrator holding connector-subsystem entitlements t
Unsandboxed Groovy script execution in Apache Syncope allows a privileged administrator to achieve server-side remote co
Sandbox escape in Apache Syncope allows a privileged administrator holding the 'Implementations' entitlement to craft a
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today