CVE-2026-86460: Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence
Published Sep 14, 2026
·Updated
Cypher injection vulnerability in the Neo4j persistence layer when processing some FIQL search conditions.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2.
Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
Affected Software
1 affected component
Apache Apache Syncope>3.0.0-M0<=3.0.16, >4.0.0-M0<=4.0.7, >4.1.0-M0<=4.1.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Syncopeto a version that resolves this vulnerability.Fixed in 4.0.8 - Upgrade
Upgrade
Apache Syncopeto a version that resolves this vulnerability.Fixed in 4.1.3
Event History
Sep 14, 2026
CVE Published
via MITRE·10:43 AM
Data Sourced
via MITRE·10:43 AM
DescriptionWeakness
Frequently Asked Questions
1
Are deployments that do not use the Neo4j persistence layer known to be affected?
The issue is identified in Syncope's Neo4j persistence layer while processing certain FIQL search conditions. The provided information does not identify other persistence layers as affected.