Executive brief
Apache Syncope, an open-source system used for managing digital identities and access control, is vulnerable to a security flaw that allows authorized administrators to run unauthorized database commands. By exploiting unsanitized sorting parameters, an attacker with administrative privileges could view, modify, or delete sensitive identity data stored in the system's database. This could lead to a total compromise of the identity management platform and the data it protects.
Technical details
An SQL injection vulnerability exists in Apache Syncope due to the improper neutralization of special elements within sort parameters. An attacker with administrative entitlements can leverage these unsanitized parameters to perform stacked queries, leading to the execution of arbitrary SQL commands against the underlying database. The vulnerability affects versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1. Users are advised to upgrade to versions 4.0.7 or 4.1.2 to remediate this flaw.
Affected products
- Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, 4.1.0-M0 through 4.1.1
Timeline
- 2026-07-20: disclosed
- 2026-07-20: advisory