CVE-2026-822329.8CriticalCWE-89
Apache Syncope: SQL injection via sort parameter in Task search
Apache Software Foundation · Apache Syncope
Not in CISA KEVVendor fix available
0.6%probability of exploitation in the next 30 days
48th percentile
050100
Higher than 48% of scored CVEs
9.8CriticalCVSS
LowMediumHighCrit.
DescriptionNVD
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort clauses for Task search. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 16 Sep.
- Apache Syncope Fixes Six Flaws, Including Critical SQL Injection and Sandbox EscapeSecurityOnline · first in our coverage
New articles also arrive in the RSS feed.