CVE-2026-77051: Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search

CVE-2026-77051 is an SQL injection vulnerability (CWE-89) in Apache Syncope, an open-source identity management platform, affecting the Audit Events search feature. An authenticated administrator with adequate entitlements can inject arbitrary SQL via stacked queries by passing unsanitized entityKey and opEvent parameters, potentially reading, modifying, or destroying data in the backing database depending on the database account's privileges. Affected versions are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2; the issue is fixed in 4.0.8 and 4.1.3 (users on the 3.0.x line have no patched 3.0 release and must upgrade). Exploitation requires administrative access, which limits the attacker pool to privileged insiders or attackers who have already compromised an admin account. No public proof-of-concept or in-the-wild exploitation is currently known, and the CVE is not in the CISA KEV catalog.

Do: Upgrade immediately to Apache Syncope 4.0.8 or 4.1.3; note there is no fixed 3.0.x release, so 3.0.x deployments must move to a patched 4.x line. If immediate upgrade is not possible, restrict access to the Syncope admin console to trusted networks and VPN, enforce least-privilege on the database account Syncope uses, and review audit logs and database query history for anomalous entityKey or opEvent values containing SQL syntax indicating exploitation attempts.