CVE-2026-77883: Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist

Apache Syncope, an open-source identity management system, is vulnerable to information disclosure (CWE-202) through crafted JEXL expressions in Derived Schemas. An administrator with Derived Schemas entitlements can define a malicious expression that uses one-hop JEXL navigation to bypass the JexlContextBuilder name denylist, causing sensitive attributes of a user's LinkedAccounts or Manager to be exposed to any administrator holding User read entitlements — potentially including hashed credentials. The flaw affects the 3.0.x, 4.0.x, and 4.1.x release lines up to 3.0.16, 4.0.7, and 4.1.2 respectively, and is fixed in 4.0.8 and 4.1.3. Exploitation requires privileged (administrator-level) access, so it primarily represents an insider-threat or compromised-admin-account risk rather than a remote unauthenticated attack. No CVSS score has been assigned yet, no public proof of concept is known, and there is no evidence of in-the-wild exploitation.

Do: Upgrade to Apache Syncope 4.0.8 or 4.1.3 as soon as possible; note that no fix is listed for the 3.0.x line, so deployments on 3.0.0-M0–3.0.16 should migrate to a patched 4.x release. Audit existing Derived Schemas for JEXL expressions that navigate to LinkedAccount or Manager attributes, and restrict Derived Schemas entitlements to the minimum set of administrators. If a suspicious expression is found, review logs for users who queried it and rotate any credentials that may have been exposed.