Apache Syncope SQL injection via unsanitized opEvent
Incomplete fix for CVE-2026-77051 allows arbitrary SQL execution as administrator.
50
Product
Syncope
- Mentions · 7d0
- Mentions · 30d5
- All mentions5
- First seenNov 2, 2026
- Last mentioned9d ago
Timeline
5 articles · newest firstApache Syncope RCE via Groovy sandbox bypass
Administrator can create malicious Groovy class to run untrusted code on separate thread.
50
Apache Syncope authorization bypass through User-Controlled key (CVE-2026-113511)
Delegated administrators can bypass Realm update boundaries without destination permission.
55
Apache Syncope AuthProfile value escalation via self-service update (CVE-2026-110535)
Non-admin users can configure impersonation for WA surrogate authentication through self-updates.
55
Apache Syncope remote code execution via Flowable JUEL expression (CVE-2026-109083)
Administrators can import arbitrary BPMN process definitions containing JUEL expressions via REST API.
50
Related CVEs
by mentions- RCE via Groovy sandbox bypass in Apache Syncope
- SQL injection in Apache Syncope via opEvent
- RCE via JUEL in Apache Syncope BPMN import
- Auth bypass in Apache Syncope for Realm subtree relocation across boundaries
- Improper Privilege Management in Apache Syncope (AuthProfile self-updates)
Appears with
- Apachevendor · 5
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.