Cypher Injection Vulnerability in Neo4j Persistence Layer Affects Apache Syncope
CVE-2026-86460

9.8CRITICAL

Key Information:

Vendor

Apache
Status
Apache Syncope
Vendor
CVE Published:
14 September 2026

What is CVE-2026-86460?

A Cypher injection vulnerability exists in the Neo4j persistence layer of Apache Syncope, which could be exploited through certain FIQL search conditions. This flaw allows attackers to manipulate Cypher queries, potentially leading to unauthorized data access or integrity issues. Users are urged to upgrade to versions 4.0.8 or 4.1.3 to rectify this security concern.

Affected Version(s)

Apache Syncope 3.0.0-M0 <= 3.0.16

Apache Syncope 4.0.0-M0 <= 4.0.7

Apache Syncope 4.1.0-M0 <= 4.1.2

References

https://lists.apache.org/thread/cwcc0pz53q6cr0tms9dh5hycb...
vendor-advisory

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

CyberLeo
Ho1aAs
.