CVE-2026-86460: Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence

Apache Syncope contains a Cypher injection flaw (classified CWE-89) in its optional Neo4j graph database persistence layer, triggered when processing certain FIQL (Feed Item Query Language) search conditions. Because FIQL is used across Syncope's REST API and administrative console for searching users, groups, and any other objects, an attacker able to submit crafted search queries could inject arbitrary Cypher fragments into the underlying query, potentially reading, altering, or deleting identity data stored in the Neo4j graph. Only deployments using the Neo4j persistence backend are vulnerable; Syncope instances on JDBC backends (the more common configuration) are not directly affected by this specific flaw. The issue affects the 3.0.0-M0–3.0.16, 4.0.0-M0–4.0.7, and 4.1.0-M0–4.1.2 release lines, with fixes available in 4.0.8 and 4.1.3. There is no known public proof of concept, CVSS score is not yet assigned, and no in-the-wild exploitation has been reported.

Do: Upgrade to Apache Syncope 4.0.8 or 4.1.3 immediately if you use the Neo4j persistence layer; users on the 3.0.x line must move to 4.0.8+ since no fixed 3.0.x release was issued. If immediate upgrade is not possible, restrict access to the Syncope REST API and console search endpoints (especially any anonymous-search capability) and audit logs for unusual FIQL query patterns against Neo4j-backed searches. Deployments on JDBC persistence are not affected by this specific issue but should still plan to upgrade during normal maintenance.