Critical · 9.8 CVE-2026-57308 EUVD-2026-45959GHSA-vqgw-p6qv-w77q

Apache Syncope: SQL injection vulnerability in Audit Events search

Published Jul 20, 2026 · Updated Jul 21, 2026 · Assigned by apache

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope.

An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort parameters.

This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1.

Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue.

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache Syncope	3.0.0-M0 – ≤ 3.0.16, 4.0.0-M0 – ≤ 4.0.6, 4.1.0-M0 – ≤ 4.1.1	—