CVE-2026-77051: Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search
Apache Syncope patches a moderate SQL injection (CVE-2026-77051) in Audit Events search via unsanitized entityKey and opEvent inputs.
CVE-2026-77051 is a moderate-severity SQL injection vulnerability in Apache Syncope's Audit Events search, caused by unsanitized entityKey and opEvent parameters. The flaw affects syncope-core-persistence-jpa 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Users should upgrade to the fixed versions in each affected line.
- SQL injection in Apache Syncope Audit Events search
- Unsanitized entityKey and opEvent parameters
- Rated moderate severity
- Affects 3.0.x, 4.0.x, and 4.1.x release lines
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-77051 | Authenticated SQL Injection in Apache Syncope Audit Events Search | 9.8 | — |
From the original article
Posted by Francesco Chicchiriccò on Sep 14 Severity: moderate Affected versions: - Apache Syncope (org. apache. syncope.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.