https://seclists.org/oss-sec/2026/q4/474: CVE-2026-114364: Apache Syncope: SQL injection via unsanitized opEvent in Audit Events search

Q: Who can exploit this issue?

Exploitation requires an Apache Syncope administrator with adequate entitlements. The advisory does not indicate that unauthenticated or ordinary users can exploit it.

Q: What access or input is used to trigger the SQL injection?

An entitled administrator can use unsanitized opEvent parameters in Audit Events search. The issue can be leveraged to execute arbitrary SQL through stacked queries.

Q: Which deployments should be prioritized for remediation?

Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, and 4.1.0-M0 through 4.1.3 are affected. The issue is fixed in 4.0.9 and 4.1.4.

Published Nov 2, 2026

Updated

Affected Software

1 affected component

Apache Syncope>=3.0.0-M0<=3.0.16, >=4.0.0-M0<=4.0.8, >=4.1.0-M0<=4.1.3

Frequently Asked Questions

Who can exploit this issue?

Exploitation requires an Apache Syncope administrator with adequate entitlements. The advisory does not indicate that unauthenticated or ordinary users can exploit it.

What access or input is used to trigger the SQL injection?

An entitled administrator can use unsanitized opEvent parameters in Audit Events search. The issue can be leveraged to execute arbitrary SQL through stacked queries.

Which deployments should be prioritized for remediation?

Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, and 4.1.0-M0 through 4.1.3 are affected. The issue is fixed in 4.0.9 and 4.1.4.