Live › vulnerability › CVE-2026-114364
An administrator with sufficient entitlements can inject stacked SQL queries through unsanitized opEvent parameters in Apache Syncope. This is an incomplete fix for CVE-2026-77051, so the attacker can run arbitrary SQL against the database.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 14:23 UTC. All times on this page are UTC.
Deployments of Apache Syncope identity management in the affected version ranges are exposed, and the attacker must already hold administrator entitlements. Installations on versions outside these ranges, or where administrative access is tightly restricted, are less exposed. Teams running Syncope 3.0.x should confirm their fixed version with the vendor since the sources only name 4.0.9 and 4.1.4.
No product ranges from the sources yet.
3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, and 4.1.0-M0 through 4.1.3 are affected.4.0.x: move to 4.0.94.1.x: move to 4.1.43.0.x: no fixed version is stated in the sources; unknownEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope.
This CVE covers an incomplete fix for CVE-2026-77051: an administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized opEvent parameters. Reference: https://cve.org/CVERecord?id=CVE-2026-77051
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3.
Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-114364")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.