CVE-2026-57308

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort parameters. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue.

Traduire en français

Produits concernés

• Apache Software Foundation Apache Syncope
• Apache syncope

Scores CVSS

Faiblesses (CWE)

• CWE-89

Références

• https://lists.apache.org/thread/g0gpctj90pbczbjl5jr33t8gr1gltg8v Mailing ListVendor Advisory
• http://www.openwall.com/lists/oss-security/2026/07/20/8 Mailing ListThird Party Advisory

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories