Vulnerability Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort parameters. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Syncope | >= 3.0.0, <= 3.0.16 |
Related Weaknesses (CWE)
References
- https://lists.apache.org/thread/g0gpctj90pbczbjl5jr33t8gr1gltg8vMailing ListVendor Advisory
- http://www.openwall.com/lists/oss-security/2026/07/20/8Mailing ListThird Party Advisory
FAQ
What is CVE-2026-57308?
CVE-2026-57308 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQ...
How severe is CVE-2026-57308?
CVE-2026-57308 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-57308?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Syncope.