CVE-2026-57308
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.83%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort parameters. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.83% probability · 56th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- apache/syncope
- Source
- security@apache.org
References
- https://lists.apache.org/thread/g0gpctj90pbczbjl5jr33t8gr1gltg8vMailing List, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2026/07/20/8Mailing List, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.