CVE-2026-42797: Apache Syncope information disclosure via malicious JEXL expression

CVE-2026-42797 · Severity: medium · CVSS 4.9 · Published 2026-05-25

Apache Syncope, an open-source system for managing digital identities, is vulnerable to an information disclosure flaw. A malicious administrator with specific permissions can create specially crafted data rules that allow other users to view sensitive security information they should not be able to see. This could lead to the exposure of private user data or internal security details, potentially compromising the integrity of the identity management system.

Technologies: Apache Software Foundation Syncope. Vendors: Apache Software Foundation, Maven.

Quick answers

Is CVE-2026-42797 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42797 being exploited in the wild.
How severe is CVE-2026-42797?
Medium severity, with a CVSS score of 4.9, published 25 May 2026.
Which products and versions are affected?
Apache Software Foundation Syncope 3.0 through 3.0.16, 4.0 through 4.0.5, 4.1.0; org.apache.syncope.core:syncope-core-provisioning-api (Maven) ECOSYSTEM:introduced=3.0.0-M0,last_affected=3.0.16.
Is there a fix for CVE-2026-42797?
A patch was published on 2026-06-30: Advisory updated with reviewed status and patch confirmation Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42797 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-42797?
Check whether you run Apache Software Foundation Syncope or org.apache.syncope.core:syncope-core-provisioning-api (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in Apache Syncope (specifically within the syncope-core-provisioning-api) allows for the exposure of sensitive information through data queries (CWE-202). The root cause is insufficient restriction of JEXL (Java Expression Language) expressions within Derived Schemas. An attacker with 'Derived Schema' entitlements can define a malicious JEXL expression that, when processed, exposes security-sensitive user data to any administrator possessing 'User read' entitlements. This is a network-based attack requiring high privileges. The issue is resolved in versions 4.0.6 and 4.1.1 by implementing stricter JEXL expression definitions.

Affected products

  • Apache Syncope 3.0 through 3.0.16, 4.0 through 4.0.5, 4.1.0

Identifiers

  • CVE-2026-42797
  • GHSA-vr35-jm2f-8wg2

Timeline

  • 2026-05-25: disclosed: Initial disclosure by Apache Software Foundation
  • 2026-05-26: advisory: GitHub Advisory published
  • 2026-06-30: patched: Advisory updated with reviewed status and patch confirmation

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.