CVE-2026-57308 PUBLISHED

Apache Syncope: SQL injection vulnerability in Audit Events search

Assigner: apache
Reserved: 24.06.2026 Published: 20.07.2026 Updated: 20.07.2026

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope.

An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort parameters.

This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1.

Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue.

Product Status

Vendor Apache Software Foundation
Product Apache Syncope
Versions Default: unaffected
  • affected from 3.0.0-M0 to 3.0.16 (incl.)
  • affected from 4.0.0-M0 to 4.0.6 (incl.)
  • affected from 4.1.0-M0 to 4.1.1 (incl.)

Credits

  • Lennart Hostettler finder

References

Problem Types

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CWE