Critical · 9.8 CVE-2026-86460 EUVD-2026-77375GHSA-h6hm-vrjv-9gv4

Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence

Published Sep 14, 2026 · Updated Sep 14, 2026 · Assigned by apache

Description

Cypher injection vulnerability in the Neo4j persistence layer when processing some FIQL search conditions.

This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2.

Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache Syncope	3.0.0-M0 – ≤ 3.0.16, 4.0.0-M0 – ≤ 4.0.7, 4.1.0-M0 – ≤ 4.1.2	—