{"id":"CVE-2026-114364","kind":"vulnerability","aliases":["CVE-2026-114364"],"related":[],"title":"Apache Syncope: admin SQL injection via opEvent lets attackers run arbitrary SQL","description":"Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope.\n\n\n\nThis CVE covers an incomplete fix for CVE-2026-77051: an administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized opEvent parameters.\nReference: https://cve.org/CVERecord?id=CVE-2026-77051\n\nThis issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3.\n\n\n\nUsers are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.","summary":"An administrator with sufficient entitlements can inject stacked SQL queries through unsanitized opEvent parameters in Apache Syncope. This is an incomplete fix for CVE-2026-77051, so the attacker can run arbitrary SQL against the database.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-syncope","identity-management","java","package"],"not_affected_if":["auth-required","fixed-version"],"how_to_check":"- Check the Syncope version in use: versions `3.0.0-M0` through `3.0.16`, `4.0.0-M0` through `4.0.8`, and `4.1.0-M0` through `4.1.3` are affected.\n- Review which accounts hold administrative entitlements in Syncope.","fix":"- Apache Syncope `4.0.x`: move to `4.0.9`\n- Apache Syncope `4.1.x`: move to `4.1.4`\n- Apache Syncope `3.0.x`: no fixed version is stated in the sources; unknown","status":"open","published_at":"2026-11-02T14:17:35+00:00","first_seen_at":"2026-11-02T14:23:24+00:00","triaged_at":"2026-11-02T14:24:56+00:00","updated_at":"2026-11-02T14:24:56+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-02T14:24:56Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Syncope `4.0.x`: move to `4.0.9`\n- Apache Syncope `4.1.x`: move to `4.1.4`\n- Apache Syncope `3.0.x`: no fixed version is stated in the sources; unknown","reach":"network","title":"Apache Syncope: admin SQL injection via opEvent lets attackers run arbitrary SQL","impact":"high","summary":"An administrator with sufficient entitlements can inject stacked SQL queries through unsanitized opEvent parameters in Apache Syncope. This is an incomplete fix for CVE-2026-77051, so the attacker can run arbitrary SQL against the database.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-syncope","identity-management","java"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs arbitrary SQL against the Syncope database","analyst_note":"Confirm whether a fixed version exists for the 3.0.x line; sources list only 4.0.9 and 4.1.4, and the referenced CVE-2026-77051 page is not in the sources.","how_to_check":"- Check the Syncope version in use: versions `3.0.0-M0` through `3.0.16`, `4.0.0-M0` through `4.0.8`, and `4.1.0-M0` through `4.1.3` are affected.\n- Review which accounts hold administrative entitlements in Syncope.","plain_action":"","needs_analyst":true,"not_affected_if":["auth-required","fixed-version"],"who_is_affected":"Deployments of Apache Syncope identity management in the affected version ranges are exposed, and the attacker must already hold administrator entitlements. Installations on versions outside these ranges, or where administrative access is tightly restricted, are less exposed. Teams running Syncope 3.0.x should confirm their fixed version with the vendor since the sources only name 4.0.9 and 4.1.4.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000788,"input_tokens":4271,"output_tokens":721,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114364':15A,18A '-2026':14A,17A,51B,87C '-77051':52B,88C '/cverecord?id=cve-2026-77051':110C '3.0.0':117C '3.0.16':120C '4.0.0':122C '4.0.8':125C '4.0.9':138C '4.1.0':127C '4.1.3':130C '4.1.4':139C 'achiev':95C 'adequ':92C 'admin':3A 'administr':28B,90C 'affect':113C 'apach':1A,20B,42B,77C,114C 'apache-syncop':19B 'arbitrari':11A,58B,98C 'attack':9A,55B 'command':72C 'cover':81C 'cve':13A,16A,50B,80C,86C 'cve.org':109C 'cve.org/cverecord?id=cve-2026-77051':108C 'databas':62B 'element':67C 'entitl':31B,93C 'execut':96C 'fix':48B,84C,141C 'ident':23B 'identity-manag':22B 'improp':63C 'incomplet':47B,83C 'inject':5A,33B,74C 'issu':112C,143C 'java':25B 'let':8A 'leverag':103C 'm0':118C,123C,128C 'manag':24B 'neutral':64C 'opev':7A,39B,105C 'packag':26B 'paramet':40B,106C 'queri':36B,102C 'recommend':133C 'refer':107C 'run':10A,57B 'special':66C 'sql':4A,12A,35B,59B,71C,73C,99C 'stack':34B,101C 'suffici':30B 'syncop':2A,21B,43B,78C,115C 'unsanit':38B,104C 'upgrad':135C 'use':68C 'user':131C 'version':137C 'via':6A,100C 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":"Deployments of Apache Syncope identity management in the affected version ranges are exposed, and the attacker must already hold administrator entitlements. Installations on versions outside these ranges, or where administrative access is tightly restricted, are less exposed. Teams running Syncope 3.0.x should confirm their fixed version with the vendor since the sources only name 4.0.9 and 4.1.4.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apachesyncope","high","identitymanagement","java","package"],"first_public_at":"2026-11-02T14:17:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114364","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114364","severity":null,"published_at":"2026-11-02T14:17:35+00:00","modified_at":"2026-11-02T14:17:35+00:00","first_seen_at":"2026-11-02T14:23:24+00:00","fetched_at":"2026-11-02T14:23:24+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}