Exposure of Sensitive Information Through Data Queries vulnerability in Apache Syncope.
An administrator with adequate entitlements for Derived Schemas can create a malicious JEXL expression which allows any administrator with sufficient entitlements for User read to access User-related security-sensitive information.
This issue affects Apache Syncope: 3.0 through 3.0.16, 4.0 through 4.0.5, 4.1.0.
Users are recommended to upgrade to version 4.0.6 / 4.1.1, which fix this issue by further restricting the JEXL expression definition.
References
| Link | Resource |
|---|---|
| https://lists.apache.org/thread/5y7d277sntyytrmxnx2tfjr9ftcpq1s6 | Mailing List Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2026/05/25/5 | Mailing List Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
28 May 2026, 20:19
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://lists.apache.org/thread/5y7d277sntyytrmxnx2tfjr9ftcpq1s6 - Mailing List, Vendor Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2026/05/25/5 - Mailing List, Third Party Advisory | |
| CPE | cpe:2.3:a:apache:syncope:*:*:*:*:*:*:*:* cpe:2.3:a:apache:syncope:4.1.0:*:*:*:*:*:*:* |
|
| First Time |
Apache
Apache syncope |
26 May 2026, 21:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.9 |
25 May 2026, 21:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-25 16:16
Updated : 2026-05-28 20:19
NVD link : CVE-2026-42797
Mitre link : CVE-2026-42797
CVE.ORG link : CVE-2026-42797
JSON object : View
Products Affected
apache
- syncope
CWE
CWE-202
Exposure of Sensitive Information Through Data Queries