CVE-2026-113687

Apache Syncope contains an incomplete fix for CVE-2026-77051 — an SQL injection vulnerability via unsanitized opEvent parameters. An administrator with adequate entitlements can execute arbitrary SQL through stacked queries.

Apache Syncope has an authorization bypass through a user-controlled key vulnerability. A delegated administrator can relocate a Realm subtree across administrative realm boundaries without permission for the destination.

Apache Syncope has an improper privilege management vulnerability. AuthProfile self-updates allow non-admin users to configure impersonation for WA surrogate authentication.

Apache Syncope has an improper isolation or compartmentalization vulnerability. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process; when a BPMN process containing a JUEL expression is imported and started, the expression is executed directly on the server with no sandbox.

An incorrect authorization vulnerability in Apache Syncope affects the Reconciliation service (pull and push). Due to incomplete delegated administration security checks, calls by administrators lacking proper entitlements may be accepted, enabling unauthorized actions.

An incorrect privilege assignment vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed (at least protocol and key), an attacker can obtain admin privileges after completing successful authentication and obtaining a valid low-privileges JWT.

Apache Syncope has an incorrect authorization vulnerability. An administrator with ClientApp's update entitlement is unable to perform the related operation, while ClientApp's create entitlement is checked both for create and update operations on ClientApp.

Apache Syncope has an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized entityKey and opEvent parameters.

Apache Syncope has a missing authorization vulnerability. An administrator with task execution entitlements might be able to mass (de)provision group members, regardless of their group-related administration capabilities.

Apache Syncope has an incorrect authorization vulnerability. An administrator with adequate entitlements in a given Realm may be able to read via REST the full Connector configuration, confidential properties included, scoped in another Realm and thus be able to effectively duplicate such Connector instance into the Realm they have administration rights for.