CVE-2026-57308

critical · 9.8

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort parameters. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue.

9.8

CVSS

0.8%

EPSS (exploit prob.)

56th

EPSS percentile

2026-07-20

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-89

Affected products

Vendor	Product	Affected versions
apache	syncope	>= 3.0.0, <= 3.0.16
apache	syncope	>= 4.0.0, < 4.0.7
apache	syncope	>= 4.1.0, < 4.1.2

Check a specific version with /api/v1/cve/match.

References

https://lists.apache.org/thread/g0gpctj90pbczbjl5jr33t8gr1gltg8v
http://www.openwall.com/lists/oss-security/2026/07/20/8

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-57308