https://seclists.org/oss-sec/2026/q3/767: CVE-2026-77883: Apache Syncope: Information disclosuvia one-hop JEXL navigation past the JexlContextBuilder name denylist

Q: Who can exploit this issue, and who can view the exposed data?

An administrator with adequate Derived Schemas entitlements must create the malicious JEXL expression. Any administrator with sufficient User read entitlements can then access sensitive LinkedAccount information, if present, or Manager information, if defined.

Q: What information may be exposed?

The issue can expose sensitive information from LinkedAccount or Manager data through crafted JEXL expressions. The advisory states that this may include hashed credentials.

Q: Which deployments are affected?

Affected releases are syncope-core-provisioning-api 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Exploitation depends on administrators having the relevant Derived Schemas and User read entitlements, and on LinkedAccount or Manager data being present or defined.

Q: What is the remediation?

Upgrade to Apache Syncope version 4.0.8 or 4.1.3, which contain the fix.

Published Sep 14, 2026

Updated

Affected Software

3 affected components

Apache Syncope>=3.0.0-M0<=3.0.16

Apache Syncope>=4.0.0-M0<=4.0.7

Apache Syncope>=4.1.0-M0<=4.1.2

Frequently Asked Questions

Who can exploit this issue, and who can view the exposed data?

An administrator with adequate Derived Schemas entitlements must create the malicious JEXL expression. Any administrator with sufficient User read entitlements can then access sensitive LinkedAccount information, if present, or Manager information, if defined.

What information may be exposed?

The issue can expose sensitive information from LinkedAccount or Manager data through crafted JEXL expressions. The advisory states that this may include hashed credentials.

Which deployments are affected?

Affected releases are syncope-core-provisioning-api 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Exploitation depends on administrators having the relevant Derived Schemas and User read entitlements, and on LinkedAccount or Manager data being present or defined.

What is the remediation?

Upgrade to Apache Syncope version 4.0.8 or 4.1.3, which contain the fix.