As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-114364: Apache Syncope: SQL injection via unsanitized opEvent in Audit Events search
CVE-2026-114364 is a SQL injection vulnerability in Apache Syncope affecting versions 3.0.0 through 4.1.3. The flaw exists in the Audit Events search functionality where the opEvent parameter is not properly sanitized, allowing an authenticated administrator to execute arbitrary SQL commands. This represents an incomplete fix for a prior vulnerability (CVE-2026-77051).
Why it matters: Administrators of Apache Syncope deployments must patch affected instances immediately to prevent authenticated SQL injection attacks that could lead to data exfiltration or system compromise.
- Source published
- First seen by Cybersecurity Tracker