EUVD-2026-77459
GHSA-qq7g-v262-hrq8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable admin API with low complexity, but exploitation demands an administrator with entitlements so PR:H; stacked-query arbitrary SQL justifies full C:H/I:H/A:H.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
5DescriptionCVE.org
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope.
An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized entityKey and opEvent parameters.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2.
Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
AnalysisAI
Stacked SQL injection in Apache Syncope (3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2) allows an authenticated administrator holding adequate entitlements to execute arbitrary SQL against the backend database by supplying malicious content in the unsanitized entityKey and opEvent parameters, which are concatenated into statements that also allow stacked (multi-statement) execution. The vendor assigned a 9.8 score with a PR:N vector, but the explicitly stated gating precondition - a privileged Syncope administrator with the relevant entitlements - means the realistic attack vector is PR:H (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so unauthenticated or low-privileged users cannot reach the vulnerable code path. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated Apache Syncope administrator holding 'adequate entitlements' - this is the explicit gating precondition stated by the vendor, directly contradicting the CVSS PR:N. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals conflict on the single most important axis: privilege. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor fix by upgrading to Apache Syncope 4.0.8 or 4.1.3, which resolve the issue across all affected release trains (users on 3.0.x should migrate to a supported 4.x line). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
For Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2, within 24 hours inventory all deployments, confirm affected versions, restrict network access to administrative interfaces, review privileged administrator accounts and entitlements, and enable audit logging for entityKey and opEvent inputs plus database multi-statement SQL activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and un
Missing authorization in Apache Syncope (3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2) le
Incorrect authorization in Apache Syncope allows a delegated administrator who holds only the ClientApp CREATE entitleme
Cross-realm authorization bypass in Apache Syncope allows an administrator who already holds delegated entitlements in o
Incorrect authorization in Apache Syncope (3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2)
Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1
A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary
An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupporte
In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow
An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not li
Reflected XSS in Apache Syncope's Enduser Login page. An attacker that tricks a legitimate user into clicking a maliciou
Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today