Cypher Injection Vulnerability in Neo4j Persistence Layer Affects Apache Syncope
CVE-2026-86460

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Syncope
Vendor
CVE Published:
14 September 2026

What is CVE-2026-86460?

A Cypher injection vulnerability exists in the Neo4j persistence layer of Apache Syncope, which could be exploited through certain FIQL search conditions. This flaw allows attackers to manipulate Cypher queries, potentially leading to unauthorized data access or integrity issues. Users are urged to upgrade to versions 4.0.8 or 4.1.3 to rectify this security concern.

Affected Version(s)

Apache Syncope 3.0.0-M0 <= 3.0.16

Apache Syncope 4.0.0-M0 <= 4.0.7

Apache Syncope 4.1.0-M0 <= 4.1.2

References

https://lists.apache.org/thread/cwcc0pz53q6cr0tms9dh5hycb...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

CyberLeo
Ho1aAs
.