As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-86460: Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence
Apache Syncope versions 3.0.0 through 4.1.2 contain a Cypher injection vulnerability in the Neo4j persistence layer when processing FIQL (Fiql Query Language) search parameters. The flaw allows attackers to manipulate database queries through specially crafted input, potentially leading to unauthorized data access or manipulation.
Why it matters: Organizations running Apache Syncope with Neo4j persistence should assess whether they are on affected versions and plan patching, as Cypher injection can bypass access controls and expose sensitive identity and access data.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-86460: Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence
Apache Syncope versions 3.0.0 through 4.1.2 contain a Cypher injection vulnerability in the Neo4j persistence layer when processing FIQL search queries. The vulnerability has a CVSS score of 9.8, indicating critical severity. Organizations running affected versions of the syncope-core-persistence-neo4j component require patching.
Why it matters: Teams managing Apache Syncope deployments with Neo4j persistence must update immediately to prevent Cypher injection attacks that could allow unauthorized database access or manipulation.
- Source published
- First seen by Cybersecurity Tracker