What is CVE-2026-57308?

CVE-2026-57308 is a critical-severity vulnerability in Apache Software Foundation Syncope, classified under SQL Injection. CVSS score: 9.8/10. Published 2026-07-20.

How severe is CVE-2026-57308?

Critical severity. CVSS v3 base score is 9.8 out of 10.

SQL Injection in Apache Software Foundation Syncope

CVE-2026-57308

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsan…

Vulnerability class: SQL Injection

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Apache Software Foundation Syncope — versions 3.0.0-M0, 4.0.0-M0, 4.1.0-M0

Weakness classification (CWE)

CWE-89 — SQL Injection

References

security@apache.org (vendor-advisory)
af854a3a-2127-422b-91ae-364da2661108

Frequently asked questions

What is CVE-2026-57308?: CVE-2026-57308 is a critical-severity vulnerability in Apache Software Foundation Syncope, classified under SQL Injection. CVSS score: 9.8/10. Published 2026-07-20.
How severe is CVE-2026-57308?: Critical severity. CVSS v3 base score is 9.8 out of 10.