CVE-2026-86460 PUBLISHED

Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence

Assigner: apache
Reserved: 07.09.2026 Published: 14.09.2026 Updated: 14.09.2026

Cypher injection vulnerability in the Neo4j persistence layer when processing some FIQL search conditions.

This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2.

Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

Product Status

Vendor Apache Software Foundation
Product Apache Syncope
Versions Default: unaffected
  • affected from 3.0.0-M0 to 3.0.16 (incl.)
  • affected from 4.0.0-M0 to 4.0.7 (incl.)
  • affected from 4.1.0-M0 to 4.1.2 (incl.)

Credits

  • CyberLeo finder
  • Ho1aAs finder

References

Problem Types

  • CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection') CWE