EUVD-2026-77378
GHSA-87r8-j2cc-8jqm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-accessible admin interface but requires high-privilege authentication (PR:H); stacked SQL grants full confidentiality, integrity, and availability impact over the IGA database.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
4DescriptionCVE.org
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope.
An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort clauses for Task search.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2.
Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
AnalysisAI
SQL injection in Apache Syncope's Task search endpoint allows an authenticated administrator to execute arbitrary SQL through unsanitized sort clause parameters via stacked queries, affecting all 3.0.x releases through 3.0.16, 4.0.x through 4.0.7, and 4.1.x through 4.1.2. The vulnerability (CWE-89) enables stacked-query injection that can read, modify, or delete identity governance data, and may allow schema manipulation or OS-level operations depending on the database engine and driver configuration. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) an authenticated session with an Apache Syncope administrator account that holds entitlements sufficient to invoke the Task search API or UI; (2) a vulnerable version (3.0.0-M0-3.0.16, 4.0.0-M0-4.0.7, or 4.1.0-M0-4.1.2); and (3) a backend database driver configuration that permits stacked (multi-statement) queries - natively supported by PostgreSQL and MSSQL, but requiring explicit enablement on MySQL/MariaDB via the `allowMultiQueries` JDBC property. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The administrative authentication prerequisite (PR:H in CVSS terms) substantially limits the realistic external attack surface - even a mid-sized municipal IT team in malbork should treat this as a low-priority external threat but a high-priority insider-threat and compromised-credential scenario, since the most plausible attack path involves phishing or credential reuse against an admin account rather than unauthenticated exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Apache Syncope 4.0.8 or 4.1.3, which resolve the unsanitized sort clause injection, per the vendor advisory at https://lists.apache.org/thread/v5zrdqcn0w0v4pk1d22ndt7frcrplo2b. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all Syncope instances in production and development environments; determine affected versions (3.0.x through 3.0.16, 4.0.x through 4.0.7, 4.1.x through 4.1.2); immediately inventory all users and service accounts with Task administrator permissions; restrict network access to the Task search endpoint to a minimal set of trusted administrators and implement API request logging for audit. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Syncope
View allSQL injection in Apache Syncope allows an administrator holding sufficient entitlements to execute arbitrary SQL through
Privilege escalation in Apache Syncope's identity-management engine lets a self-service user grant themselves defined Ro
Server-Side Request Forgery in Apache Syncope lets a low-privileged authenticated user abuse the Connectors and Resource
Incorrect authorization in Apache Syncope's delegated administration module allows an authenticated delegated administra
OIDC client secret exposure in Apache Syncope enables any authenticated user to retrieve complete OIDC provider configur
Sensitive AES key material is written in plaintext to Apache Syncope application logs under a specific misconfiguration
CSV formula injection in Apache Syncope allows authenticated low-privilege users to embed spreadsheet formula payloads i
Code execution via Groovy sandbox bypass in Apache Syncope 3.0 through 3.0.16, 4.0 through 4.0.5, and 4.1.0 allows a hig
Remote code execution in Apache Syncope's connector subsystem allows an administrator holding sufficient entitlements to
Remote code execution in Apache Syncope's workflow engine lets an administrator holding sufficient entitlements run arbi
Groovy sandbox escape in Apache Syncope's Implementations feature lets an administrator holding Implementation entitleme
Broken delegated-administration authorization in Apache Syncope's Reconciliation service lets an authenticated administr
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today