CVE-2026-114364: Apache Syncope: SQL injection via unsanitized opEvent in Audit Events search

Published Nov 2, 2026

Updated

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope.

This CVE covers an incomplete fix for CVE-2026-77051: an administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized opEvent parameters. Reference: https://cve.org/CVERecord?id=CVE-2026-77051

This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3.

Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.

Event History

Nov 2, 2026

CVE Published

via NVD·02:17 PM

Data Sourced

via NVD·02:17 PM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An administrator with adequate entitlements is required. The attacker must be able to supply opEvent parameters to the Audit Events search functionality.

What is the impact of successful exploitation?

A suitably entitled administrator can execute arbitrary SQL through stacked queries by leveraging unsanitized opEvent parameters.

Which Apache Syncope versions require remediation?

Affected releases are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, and 4.1.0-M0 through 4.1.3. Upgrade to 4.0.9 or 4.1.4 to fix the issue.

CVE-2026-114364: Apache Syncope: SQL injection via unsanitized opEvent in Audit Events search

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the impact of successful exploitation?

Which Apache Syncope versions require remediation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the impact of successful exploitation?

Which Apache Syncope versions require remediation?