Apache Syncope EUVD-2026-77378

Exploitation requires: (1) an authenticated session with an Apache Syncope administrator account that holds entitlements sufficient to invoke the Task search API or UI; (2) a vulnerable version (3.0.0-M0-3.0.16, 4.0.0-M0-4.0.7, or 4.1.0-M0-4.1.2); and (3) a backend database driver configuration that permits stacked (multi-statement) queries - natively supported by PostgreSQL and MSSQL, but requiring explicit enablement on MySQL/MariaDB via the allowMultiQueries JDBC property. Limiting factors include the mandatory administrative authentication, which entirely prevents unauthenticated or low-privileged exploitation; the stacked-query database-driver dependency, which may neutralize the arbitrary-execution primitive on some deployments while still allowing sort-clause manipulation for information disclosure; and the requirement that the sort parameter reach an unsanitized code path, which is constrained to the Task search surface.

The administrative authentication prerequisite (PR:H in CVSS terms) substantially limits the realistic external attack surface - even a mid-sized municipal IT team in malbork should treat this as a low-priority external threat but a high-priority insider-threat and compromised-credential scenario, since the most plausible attack path involves phishing or credential reuse against an admin account rather than unauthenticated exploitation. No vendor-provided CVSS vector exists; all metric assessments are inferred from the description and CWE. No EPSS score is available, no public proof-of-concept exploit has been identified, and the vulnerability is not listed in the CISA KEV catalog, collectively suggesting no active exploitation at time of analysis. The impact potential is elevated by stacked-query capability - arbitrary SQL execution against an IGA database storing credential hashes, entitlement records, and provisioning workflows represents a high-confidentiality and high-integrity risk if the admin account is compromised. The absence of a 3.0.x patch introduces upgrade-pressure risk for organizations on that branch.

An attacker who has obtained administrative credentials - through phishing, credential stuffing, or insider access - logs into the Apache Syncope administrative console and submits a Task search request with a crafted sort parameter containing a stacked SQL payload (e.g., appending a semicolon-separated INSERT or SELECT INTO OUTFILE statement). The database engine processes both statements, allowing the attacker to exfiltrate hashed credentials and entitlement records or insert rogue administrative accounts. No public proof-of-concept code has been identified at time of analysis.