CVE-2026-86460: Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence
Apache Syncope's Neo4j persistence layer permits Cypher injection via certain FIQL search expressions, affecting versions through 3.0.16, 4.0.7, and 4.1.2.
CVE-2026-86460 is a moderate-severity Cypher injection in Apache Syncope's syncope-core-persistence-neo4j module, triggered when processing some FIQL search strings. Affected versions are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. No exploitation is reported; upgrade to fixed releases is advised.
- Cypher injection in Neo4j persistence when processing FIQL search
- Affects Syncope 3.0.0-M0-3.0.16, 4.0.0-M0-4.0.7, 4.1.0-M0-4.1.2
- Upstream severity rated moderate
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-86460 | Cypher Injection via FIQL Search in Apache Syncope Neo4j Persistence Layer | 9.8 | — |
From the original article
Posted by Francesco Chicchiriccò on Sep 14 Severity: moderate Affected versions: - Apache Syncope (org. apache. syncope.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.