CVE-2026-82232: Apache Syncope: SQL injection via sort parameter in Task search

Apache Syncope contains a SQL injection flaw (CWE-89) in the Task search function, where sort clauses are passed to the database without proper neutralization of special elements. An administrator with adequate entitlements can exploit this through stacked queries to execute arbitrary SQL against the backend database. Successful exploitation allows the attacker to read, modify, or delete data at the level of the database account used by Syncope, making this primarily a risk from malicious or compromised privileged accounts. All users of Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 are affected. No CVSS score has been assigned, the issue is not in the CISA KEV catalog, and no public proof-of-concept or observed exploitation is known at this time.

Do: Upgrade to Apache Syncope 4.0.8 or 4.1.3, which fix the issue; note that no fixed 3.0.x release is listed, so 3.0.16-and-earlier deployments should migrate to a patched 4.x release. As defense in depth, restrict Syncope administrative entitlements to the minimum necessary set of users and review who can invoke Task searches. Check database audit logs for unexpected stacked or multi-statement queries originating from the Syncope service account to rule out prior abuse.