CYBERSECURITYTRACKER
Permanent story citation

CVE-2026-77883: Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 7280

As cited

Copy frozen at (site build).

vulnerabilities

CVE-2026-77883: Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist

CVE-2026-77883 is a moderate severity vulnerability in Apache Syncope versions 3.0.0 through 4.1.2 that allows information disclosure through one-hop Java Expression Language (JEXL) navigation circumventing the JexlContextBuilder name denylist. An administrator can exploit this to access sensitive data via crafted queries.

Why it matters: Apache Syncope administrators and operators running affected versions 3.0.0-M0 through 4.1.2 should review access controls and apply patches to prevent unauthorized information exposure through JEXL expressions.

CVEsCVE-2026-77883
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary

Open in glossary