# CVE-2026-42797: Apache Syncope information disclosure via malicious JEXL expression

Source: https://junglewise.ai/threats/cve-2026-42797-apache-syncope-information-disclosure-via-malicious-jexl  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-25. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-42797 · Severity: medium · CVSS 4.9 · Published 2026-05-25

Apache Syncope, an open-source system for managing digital identities, is vulnerable to an information disclosure flaw. A malicious administrator with specific permissions can create specially crafted data rules that allow other users to view sensitive security information they should not be able to see. This could lead to the exposure of private user data or internal security details, potentially compromising the integrity of the identity management system.

Technologies: [Apache Software Foundation Syncope](https://junglewise.ai/threats/technologies/syncope). Vendors: [Apache Software Foundation](https://junglewise.ai/threats/vendors/apache-software-foundation), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-42797 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42797 being exploited in the wild.

**How severe is CVE-2026-42797?** Medium severity, with a CVSS score of 4.9, published 25 May 2026.

**Which products and versions are affected?** Apache Software Foundation Syncope 3.0 through 3.0.16, 4.0 through 4.0.5, 4.1.0; org.apache.syncope.core:syncope-core-provisioning-api (Maven) ECOSYSTEM:introduced=3.0.0-M0,last_affected=3.0.16.

**Is there a fix for CVE-2026-42797?** A patch was published on 2026-06-30: Advisory updated with reviewed status and patch confirmation Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42797 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-42797?** Check whether you run Apache Software Foundation Syncope or org.apache.syncope.core:syncope-core-provisioning-api (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability in Apache Syncope (specifically within the syncope-core-provisioning-api) allows for the exposure of sensitive information through data queries (CWE-202). The root cause is insufficient restriction of JEXL (Java Expression Language) expressions within Derived Schemas. An attacker with 'Derived Schema' entitlements can define a malicious JEXL expression that, when processed, exposes security-sensitive user data to any administrator possessing 'User read' entitlements. This is a network-based attack requiring high privileges. The issue is resolved in versions 4.0.6 and 4.1.1 by implementing stricter JEXL expression definitions.

## Affected products

- Apache Syncope 3.0 through 3.0.16, 4.0 through 4.0.5, 4.1.0

## Identifiers

- CVE-2026-42797
- GHSA-vr35-jm2f-8wg2

## Timeline

- 2026-05-25: disclosed: Initial disclosure by Apache Software Foundation
- 2026-05-26: advisory: GitHub Advisory published
- 2026-06-30: patched: Advisory updated with reviewed status and patch confirmation

## References

- [https://lists.apache.org/thread/5y7d277sntyytrmxnx2tfjr9ftcpq1s6](https://lists.apache.org/thread/5y7d277sntyytrmxnx2tfjr9ftcpq1s6)
- [http://www.openwall.com/lists/oss-security/2026/05/25/5](http://www.openwall.com/lists/oss-security/2026/05/25/5)

## Related threats

- [Apache Syncope SSRF in Connectors and Resources check](https://junglewise.ai/threats/cve-2026-62418-apache-syncope-ssrf-in-connectors-and-resources-check)
- [Apache Syncope remote code execution via BPMN Groovy scripts](https://junglewise.ai/threats/cve-2026-53405-apache-syncope-remote-code-execution-via-bpmn-groovy-scripts)
- [Apache Syncope sandbox escape via Groovy static initializer](https://junglewise.ai/threats/cve-2026-42782-apache-syncope-sandbox-escape-via-groovy-static-initializer)