As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-82232: Apache Syncope: SQL injection via sort parameter in Task search
Apache Syncope versions 3.0.0 through 3.0.16, 4.0.0 through 4.0.7, and 4.1.0 through 4.1.2 contain a SQL injection vulnerability in the Task search sort parameter. An attacker can exploit this flaw to execute arbitrary SQL commands through improper neutralization of special elements in SQL statements.
Why it matters: Organizations running affected Syncope instances must patch immediately; this vulnerability allows unauthenticated or authenticated attackers to extract data or compromise database integrity depending on Syncope's deployment context and access controls.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-82232: Apache Syncope: SQL injection via sort parameter in Task search
Apache Syncope contains a SQL injection vulnerability in the sort parameter of the Task search functionality, affecting versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. The vulnerability, CVE-2026-82232, carries a CVSS score of 9.8 (critical), indicating severe risk from improper neutralization of special elements in SQL commands.
Why it matters: Syncope administrators and users of affected versions face critical remote code execution risk and must apply patches or upgrade immediately to prevent attackers from executing arbitrary SQL commands through the Task search interface.
- Source published
- First seen by Cybersecurity Tracker