CVE-2026-57308

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-57308

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57308.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-57308

Published

2026-07-20T14:21:57.415Z

Modified

2026-08-12T03:51:16.993241935Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Apache Syncope: SQL injection vulnerability in Audit Events search

Details

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope.

An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort parameters.

This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1.

Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue.

Database specific

{
    "cna_assigner": "apache",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "3.0.0-M0"
                },
                {
                    "last_affected": "3.0.16"
                },
                {
                    "introduced": "4.0.0-M0"
                },
                {
                    "last_affected": "4.0.6"
                },
                {
                    "introduced": "4.1.0-M0"
                },
                {
                    "last_affected": "4.1.1"
                }
            ]
        },
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "introduced": "3.0.0-M0"
                },
                {
                    "fixed": "3.0.16"
                },
                {
                    "introduced": "4.0.0-M0"
                },
                {
                    "fixed": "4.0.6"
                },
                {
                    "introduced": "4.1.0-M0"
                },
                {
                    "fixed": "4.1.1"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57308.json",
    "cwe_ids": [
        "CWE-89"
    ]
}

References

Affected packages

Git / github.com/apache/syncope

Affected ranges

Type

GIT

Repo

https://github.com/apache/syncope

Events

Introduced

d4a8b1eb53b246c42acb757739637be02838a082

Last affected

2b741bd0d6b4f49779a0c01cad597c6a15f93351

Introduced

b0c019c1256bf433bf60e3211ee8711dae03e6bc

Fixed

84abc48d024599ca49ef07b726e698206120ffd9

Introduced

7afe57a317c88ebedf75ca8d714ad743e5cd1d24

Fixed

1607ab1fff8542e6fdd634ff68b9afd03d80dd8c

Database specific

Show details

{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:apache:syncope:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "3.0.0"
        },
        {
            "last_affected": "3.0.16"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.0.7"
        },
        {
            "introduced": "4.1.0"
        },
        {
            "fixed": "4.1.2"
        }
    ]
}

Affected versions

syncope-3.*

syncope-3.0.0

syncope-3.0.1

syncope-3.0.10

syncope-3.0.11

syncope-3.0.12

syncope-3.0.13

syncope-3.0.14

syncope-3.0.15

syncope-3.0.16

syncope-3.0.2

syncope-3.0.3

syncope-3.0.4

syncope-3.0.5

syncope-3.0.6

syncope-3.0.7

syncope-3.0.8

syncope-3.0.9

syncope-4.*

syncope-4.0.0

syncope-4.0.1

syncope-4.0.2

syncope-4.0.3

syncope-4.0.4

syncope-4.0.5

syncope-4.0.6

syncope-4.1.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57308.json"