Cyber ·
CVE-2026-114364: SQL injection in Apache Syncope through the audit event search
A SQL injection flaw in Apache Syncope lets an administrator with adequate permissions run arbitrary SQL. The advisory, published on 2 November 2026, rates severity as important and notes that an earlier fix, CVE-2026-77051, was incomplete.
Radar records advisory CVE-2026-114364, disclosed on 2 November 2026 through the oss-sec feed and posted by Francesco Chicchiriccò. The flaw is SQL injection: the opEvent value is not sanitized in the audit event search of Apache Syncope, and an administrator with adequate permissions can run arbitrary SQL. The stated severity is important. Affected versions are Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, and 4.1.0-M0 through 4.1.3. The advisory also says this CVE covers an incomplete fix for CVE-2026-77051. To verify, consult the original text in the public oss-sec list archive and the Apache Syncope security page, and confirm your installed version against the affected range. Relevance to Rota Nacional is indirect: the platform does not patch or host Syncope, and this advisory does not describe any Rota capability. If your organization uses Syncope for identity management, upgrade to a fixed release once the project names one, and review administrative permissions and audit logs.