Apache Syncope CVE-2026-86460

Exploitation requires all of the following: the target Syncope deployment must use the Neo4j persistence layer as its active backend (this is an optional configuration - deployments using only JPA/relational backends are not affected); the attacker must hold valid credentials to authenticate against the Syncope REST API; and the request must target a FIQL-enabled search endpoint that processes the injected input through the vulnerable Neo4j query builder. Limiting factors are the optional Neo4j backend (non-default in many deployments), the authentication requirement (PR:L - unauthenticated access is not sufficient), and the FIQL-specific code path. The vulnerability does not affect Syncope instances backed solely by relational databases.

No CVSS vector was provided for this CVE, requiring full metric inference from description and architecture. The attack vector is clearly network (REST API), complexity is low once the attacker has API access (injection flaws are mechanically straightforward), and authentication is almost certainly required (PR:L) since Syncope's REST search endpoints are gated behind identity management controls. The Neo4j backend must be configured and active, which acts as a deployment-specific attack prerequisite - this meaningfully narrows the real-world population of vulnerable targets compared to the raw affected-version count. No EPSS score was available for quantitative exploitation probability assessment, and no CISA KEV listing is present. The multi-branch scope (three independent release lines) suggests the flaw was introduced early in the Neo4j integration and persisted through multiple refactors, which is a signal of architectural rather than incidental weakness. Even a mid-sized municipal IT team in legnica running Syncope for employee identity provisioning should treat this as urgent given that identity stores contain credentials, role assignments, and organizational relationships whose exposure carries significant downstream risk. No public exploit code has been identified at time of analysis.

An authenticated Syncope REST API user submits a crafted FIQL search string - for example a user search condition - containing Cypher injection syntax that appends an additional MATCH or RETURN clause to the generated query. The injected Cypher executes against the Neo4j backend and returns user credential hashes, role assignments, or organizational node data outside the requester's authorized scope. No public exploit code has been identified at time of analysis.