SQL Injection Vulnerability in Apache Syncope by Apache

CVE-2026-57308

What is CVE-2026-57308?

A vulnerability in Apache Syncope allows an administrator with sufficient privileges to execute arbitrary SQL commands. By exploiting unsanitized sort parameters in stacked queries, an attacker may manipulate the database. The framework versions affected include 3.0.0-M0 to 3.0.16, 4.0.0-M0 to 4.0.6, and 4.1.0-M0 to 4.1.1. To mitigate the risk, users should upgrade to the patched versions 4.0.7 or 4.1.2.

References