CVE-2026-77883: Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist
Apache Syncope's JEXL template engine permits one-hop navigation past the JexlContextBuilder name denylist, enabling administrator-driven information disclosure.
CVE-2026-77883 is a moderate-severity exposure of sensitive information through data queries in Apache Syncope's syncope-core-provisioning-api module. An administrator can bypass the JexlContextBuilder name denylist using one-hop JEXL navigation to reach sensitive data. Affected versions are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.
- Denylist bypass via one-hop JEXL navigation
- Requires administrator access, limiting practical impact
- Affects Syncope 3.0.x through 4.1.2
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-77883 | Sensitive data exposure via malicious JEXL expression in Apache Syncope | 4.9 | — |
From the original article
Posted by Francesco Chicchiriccò on Sep 14 Severity: moderate Affected versions: - Apache Syncope (org. apache. syncope.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.