CRITICAL🇵🇱 Wersja polska

CVE-2026-57308

CVSS 9.8pub. 2026-07-20upd. 2026-07-27

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort parameters. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Apache Syncope

    APP
    Apache
    3.0.0 – 3.0.164.0.0 – 4.0.7 (excl.)4.1.0 – 4.1.2 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
SQLi
CWE
References

Related vulnerabilities

CVE-2026-62183CRITICAL9.8PL ✓same product

Apache Syncope — privilege escalation do poziomu administratora przez REST API

CVE-2026-63071CRITICAL9.8PL ✓same product

Apache Syncope – ominięcie sandboxa Groovy przez administratora

CVE-2026-53421CRITICAL9.8PL ✓same product

Apache Syncope — RCE przez niebezpieczne wykonywanie skryptów Groovy

CVE-2026-53405CRITICAL9.8PL ✓same product

Apache Syncope: Wykonanie kodu Groovy bez sandbox przez BPMN REST API

CVE-2020-1961CRITICAL9.8PL ✓same product

Apache Syncope: Server-Side Template Injection w szablonach e-mail (RCE)