CVE-2026-77051 PUBLISHED

Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search

Assigner: apache
Reserved: 20.08.2026 Published: 14.09.2026 Updated: 14.09.2026

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope.

An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized entityKey and opEvent parameters.

This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2.

Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

Product Status

Vendor Apache Software Foundation
Product Apache Syncope
Versions Default: unaffected
  • affected from 3.0.0-M0 to 3.0.16 (incl.)
  • affected from 4.0.0-M0 to 4.0.7 (incl.)
  • affected from 4.1.0-M0 to 4.1.2 (incl.)

Credits

  • n0mi1k finder
  • Ho1aAs finder

References

Problem Types

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CWE