Apache Syncope EUVD-2026-77459

Requires an authenticated Apache Syncope administrator holding 'adequate entitlements' - this is the explicit gating precondition stated by the vendor, directly contradicting the CVSS PR:N. Given that access, the attacker supplies malicious content in the entityKey or opEvent parameters, which are not sanitized and are concatenated into SQL, enabling stacked (multi-statement) queries. Limiting factors: exploitation is impossible for unauthenticated or low-privileged users; it depends on possessing an admin account with the relevant entitlements, so exposure scales with how many privileged operators exist and how reachable the admin console/REST API is. Affected: Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2; upgrading to 4.0.8 / 4.1.3 removes the condition.

Signals conflict on the single most important axis: privilege. The published CVSS 3.1 vector is 9.8 with PR:N (unauthenticated), yet the description is explicit that exploitation requires 'an administrator with adequate entitlements' - i.e. an authenticated, privileged Syncope operator. This is a material overstatement: the true precondition is a privileged admin session, so real-world risk is far narrower than the 9.8/PR:N implies (assessed PR:H). The technical impact once that bar is cleared is genuinely severe - stacked SQL queries via the entityKey/opEvent parameters permit arbitrary SQL execution, which underpins the C:H/I:H/A:H impact and the SSVC 'Technical Impact: total' rating. However, SSVC 'Exploitation: none', EPSS 0.56% (45th percentile, low), no CISA KEV listing, and no public POC all indicate this is not under active or imminent widespread exploitation. Net: this is a high-impact-but-privilege-gated flaw, not a drive-by internet threat - priority for organizations running affected Syncope where admin accounts are numerous, semi-trusted, or reachable, but the 9.8 headline should be discounted because PR:N contradicts the vendor's own text. SSVC 'Automatable: yes' refers to the technical exploitation step, not to gaining the required admin access.

A Syncope administrator (or an attacker who has phished/compromised such an account, or an over-provisioned internal operator abusing entitlements) submits crafted values in the entityKey or opEvent parameters that are concatenated unsanitized into a SQL statement. Because stacked queries are possible, the attacker appends arbitrary SQL - reading or modifying the entire identity store, escalating privileges, or corrupting/deleting data. No public exploit code has been identified at time of analysis, though exploitation is straightforward once admin entitlements are held.