Executive brief
Apache Syncope is an identity and access management platform. An attacker with administrative privileges over Derived Schemas can craft malicious JEXL expressions to expose sensitive user data—including hashed credentials, linked account information, and manager details—to other administrators. This could lead to unauthorized access to user accounts and credential compromise.
Technical details
The vulnerability is an expression injection flaw in Apache Syncope's handling of JEXL expressions within Derived Schemas. An administrator with sufficient entitlements can create a malicious JEXL expression that, when evaluated during user data queries, exposes sensitive fields (LinkedAccount, Manager, hashed credentials) to any other administrator with User read permissions. The attack requires administrative privileges to create the malicious schema, but leverages the JEXL expression engine to bypass data access controls. The issue affects versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Patched versions 4.0.8 and 4.1.3 are available.
Affected products
- Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, 4.1.0-M0 through 4.1.2
Timeline
- 2026-09-14: disclosed