SQL Injection in Apache Syncope
CVE-2026-57308
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort parameters. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue.
Vulnerability class: SQL Injection
EPSS: 0.008 (55.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Apache Syncope
- Apache Software Foundation Syncope — versions 3.0.0-M0, 4.0.0-M0, 4.1.0-M0
Weakness classification (CWE)
References
- security@apache.org (vendor-advisory, Mailing List, Vendor Advisory)
- af854a3a-2127-422b-91ae-364da2661108 (Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2026-57308?
- CVE-2026-57308 is a critical-severity vulnerability in Apache Syncope, classified under SQL Injection. CVSS score: 9.8/10. Published 2026-07-20.
- How severe is CVE-2026-57308?
- Critical severity. CVSS v3 base score is 9.8 out of 10.