PT-2026-135430

CVE-2026-114364

·

Published

2026-11-02

·

Updated

2026-11-02

Description by

Score
N/A
Not available

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope.
This CVE covers an incomplete fix for CVE-2026-77051: an administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized opEvent parameters. Reference: https://cve.org/CVERecord?id=CVE-2026-77051
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3.
Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')
Related identifiers
CVE-2026-114364
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com