CVE-2026-82232: Apache Syncope: SQL injection via sort parameter in Task search
Apache Syncope's JPA persistence layer allows SQL injection via the sort parameter in Task search, affecting all releases through 4.1.2.
CVE-2026-82232 is rated important by upstream: improper neutralization of special elements in an SQL command allows SQL injection through the sort parameter in Task search within syncope-core-persistence-jpa. Affected versions are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. No exploitation in the wild is reported.
- SQL injection via sort parameter in Task search
- Rated important severity by Apache
- Affects Syncope 3.0.x through 4.1.x JPA persistence module
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82232 | Privileged SQL Injection via Sort Clause in Apache Syncope | 9.8 | — |
From the original article
Posted by Francesco Chicchiriccò on Sep 14 Severity: important Affected versions: - Apache Syncope (org. apache. syncope.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.