---
id: "CVE-2026-114364"
kind: "vulnerability"
aliases: ["CVE-2026-114364"]
title: "Apache Syncope: admin SQL injection via opEvent lets attackers run arbitrary SQL"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-syncope", "identity-management", "java", "package"]
not_affected_if: ["auth-required", "fixed-version"]
published_at: "2026-11-02T14:17:35+00:00"
first_seen_at: "2026-11-02T14:23:24+00:00"
updated_at: "2026-11-02T14:24:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114364", "first_seen_at": "2026-11-02T14:23:24+00:00"}]
---

# Apache Syncope: admin SQL injection via opEvent lets attackers run arbitrary SQL

An administrator with sufficient entitlements can inject stacked SQL queries through unsanitized opEvent parameters in Apache Syncope. This is an incomplete fix for CVE-2026-77051, so the attacker can run arbitrary SQL against the database.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Syncope version in use: versions `3.0.0-M0` through `3.0.16`, `4.0.0-M0` through `4.0.8`, and `4.1.0-M0` through `4.1.3` are affected.
- Review which accounts hold administrative entitlements in Syncope.

## Fix

- Apache Syncope `4.0.x`: move to `4.0.9`
- Apache Syncope `4.1.x`: move to `4.1.4`
- Apache Syncope `3.0.x`: no fixed version is stated in the sources; unknown

## Timeline

- 2026-11-02T14:23:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114364

## From the sources

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope.



This CVE covers an incomplete fix for CVE-2026-77051: an administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized opEvent parameters.
Reference: https://cve.org/CVERecord?id=CVE-2026-77051

This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3.



Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_