Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitymedium

Apache Syncope SQL injection via unsanitized opEvent

Original title: CVE-2026-114364: Apache Syncope: SQL injection via unsanitized opEvent in Audit Events search

oss-security ()1
Read at seclists.org
Part of a story covered by 5 sourcesApache Syncope vulnerabilities enable RCE, bypasses and escalationMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Incomplete fix for CVE-2026-77051 allows arbitrary SQL execution as administrator.

Apache Syncope has an SQL injection vulnerability in the Audit Events search due to unsanitized opEvent input. An administrator can achieve arbitrary SQL execution. The issue was introduced by an incomplete fix for CVE-2026-77051. Affected versions include Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, and 4.1.0-M0 through 4.1.3.

Key facts
  • Severity: important
  • Affects 3.0.0-M0-3.0.16, 4.0.0-M0-4.0.8, 4.1.0-M0-4.1.3
  • Admin with entitlements can execute SQL
Security assessment · AI, from the articleNo known exploitation

Impact: arbitrary SQL execution

Analyze CVE-2026-114364 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-114364
Tags
apachesyncopesql-injection
Vendors
Apache
Products
Syncope

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-114364
SQL injection in Apache Syncope via opEvent
9.8—

From the original article

Posted by Francesco Chicchiriccò on Nov 02 Severity: important Affected versions: - Apache Syncope 3. 0. 0-M0 through 3.

oss-security

seclists.org

Read the full article at oss-security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.