CVE-2026-114364: SQL injection in Apache Syncope via unsanitized opEvent in audit event search

What happened and what to do

The advisory, published on 2 November 2026 by Francesco Chicchiriccò and shared on the oss-sec list, describes CVE-2026-114364, rated important. The problem is the opEvent parameter, which is not sanitized in the audit event search. Affected versions are Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8 and 4.1.0-M0 through 4.1.3. It is an incomplete fix of CVE-2026-77051, meaning the earlier correction did not cover all input paths.

In practice, a company running Syncope should first inventory production and staging instances and their versions, apply the official update as soon as it is available for the line in use, and restrict administrative access to the console. In parallel, audit the logs of audit event queries for unusual patterns in the opEvent parameter. If the update cannot be applied immediately, a proxy or request filter in front of the administrative interface, with parameter validation and centralized logging, can reduce risk while the fix is planned.

How the consultancy can help

Wendelmaques can run an exposure diagnosis of your Syncope environment: version inventory, a review of who holds administrative roles, and an audit of log activity. It can then propose a staged update plan and, if needed, a temporary protection layer with continuous monitoring.

Next step

If your company uses Apache Syncope, send a short description of your environment, the versions in use and how administrative access is controlled. We will reply with a scoped proposal for diagnosis and implementation.