CVE-2026-42797
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
Apache Syncope versions 3.0 to 3.0.16, 4.0 to 4.0.5, and 4.1.0 have a sensitive information disclosure vulnerability via malicious JEXL expressions in Derived Schemas. An administrator with sufficient entitlements can access user-related security-sensitive information.
Risk Assessment
An attacker administrator can read confidential user data, compromising privacy and data security.
Recommendation
Update Apache Syncope to version 4.0.6 or 4.1.1, which restrict JEXL expression definitions.
Other vulnerabilities in Apache Syncope
See all- CVE-2026-63071Critical
An Improper Isolation or Compartmentalization vulnerability in Apache Syncope allows an administrator with adequate entitlements to create a malicious Groovy class containing untrusted code, bypassing the Groovy security sandbox.
- CVE-2026-62183Critical
An improper privilege management vulnerability exists in Apache Syncope. A user can exploit a REST API call to grant themselves administrative roles, gaining full control over the system. Affected versions: 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1.
- CVE-2026-57308Critical
An SQL Injection vulnerability in Apache Syncope allows an administrator with adequate entitlements to execute arbitrary SQL via stacked queries using unsanitized sort parameters. Affected versions: 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1.
- CVE-2026-53421Critical
An improper isolation or compartmentalization vulnerability exists in Apache Syncope. An administrator with adequate entitlements can achieve remote code execution through the connector subsystem by relying on scripted connectors (REST and SQL) to run Groovy scripts.
- CVE-2026-53405Critical
A vulnerability in Apache Syncope allows improper isolation of Groovy scripts in BPMN processes. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and start them, causing the Groovy script to execute directly on the server without a sandbox.
- CVE-2026-62418High
An authenticated Server-Side Request Forgery (SSRF) vulnerability with low privileges was found in Apache Syncope via Connectors and Resources check. It allows an attacker to send requests from the server to internal systems.
- CVE-2026-42782High
Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can create a malicious Groovy class containing untrusted code reaching a non-sandboxed execution path via the class static initializer. This affects versions 3.0 through 3.0.16, 4.0 through 4.0.5, and 4.1.0. Fixed in 4.0.6 and 4.1.1.
Original NVD description (English source)
Exposure of Sensitive Information Through Data Queries vulnerability in Apache Syncope. An administrator with adequate entitlements for Derived Schemas can create a malicious JEXL expression which allows any administrator with sufficient entitlements for User read to access User-related security-sensitive information. This issue affects Apache Syncope: 3.0 through 3.0.16, 4.0 through 4.0.5, 4.1.0. Users are recommended to upgrade to version 4.0.6 / 4.1.1, which fix this issue by further restricting the JEXL expression definition.