{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-114364","assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","state":"PUBLISHED","assignerShortName":"apache","dateReserved":"2026-10-21T09:16:02.274Z","datePublished":"2026-11-02T13:12:27.512Z","dateUpdated":"2026-11-02T13:12:27.512Z"},"containers":{"cna":{"providerMetadata":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-11-02T13:12:27.512Z"},"title":"Apache Syncope: SQL injection via unsanitized opEvent in Audit Events search","problemTypes":[{"descriptions":[{"description":"CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')","lang":"en","cweId":"CWE-89","type":"CWE"}]}],"source":{"discovery":"UNKNOWN"},"affected":[{"vendor":"Apache Software Foundation","product":"Apache Syncope","packageURL":"pkg:maven/org.apache.syncope.core/syncope-core-persistence-jpa","versions":[{"status":"affected","version":"3.0.0-M0","lessThanOrEqual":"3.0.16","versionType":"semver"},{"status":"affected","version":"4.0.0-M0","lessThanOrEqual":"4.0.8","versionType":"semver"},{"status":"affected","version":"4.1.0-M0","lessThanOrEqual":"4.1.3","versionType":"semver"}],"defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.syncope.core:syncope-core-persistence-jpa"}],"descriptions":[{"value":"Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope.\n\n\n\nThis CVE covers an incomplete fix for CVE-2026-77051: an administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized opEvent parameters.\nReference: https://cve.org/CVERecord?id=CVE-2026-77051\n\nThis issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3.\n\n\n\nUsers are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.","lang":"en","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope.</p><p>This CVE covers an incomplete fix for CVE-2026-77051: an administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized opEvent parameters.<br>Reference: https://cve.org/CVERecord?id=CVE-2026-77051<br><br>This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3.</p><p>Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.</p>"}]}],"references":[{"url":"https://lists.apache.org/thread.html/j65oo441q5gpr4d0ljb644r9mdro2slm","tags":["vendor-advisory"]}],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"important"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"credits":[{"lang":"en","value":"Alex Palinkash","type":"finder"}],"x_generator":{"engine":"Vulnogram 1.0.3"}}}}