Apache Syncope Patches 7 Critical Flaws

The Apache Software Foundation patched seven critical vulnerabilities in Apache Syncope, an open-source identity governance and provisioning platform used in enterprise IAM stacks. All seven advisories hit the Apache security mailing list on September 14. None are confirmed as exploited in the wild.

That said: seven critical-rated CVEs covering SQL injection, JWT forgery, and authentication bypass in an identity store. Patch within the day.

Injection paths

CVE-2026-73579 (CVSS 9.8) is the widest exposure. Syncope’s search API translates FIQL conditions into backend queries: SQL, Neo4j, or Elasticsearch/OpenSearch depending on deployment. The translation does not adequately sanitize inputs. Any authenticated user with search access can inject commands into the configured persistence layer.

CVE-2026-86460 (CVSS 9.8) targets the Neo4j layer specifically: FIQL conditions reach the Cypher query engine without escaping. Affects 3.0.0-M0 through 3.0.16 and the 4.x branch. If your deployment uses Neo4j and CVE-2026-73579 applies, this one does too.

CVE-2026-82232 (CVSS 9.8) is a SQL injection path reachable by administrators with adequate entitlements. The access bar is higher, but admin-level SQL execution against an identity store still puts the entire credential database within reach.

JWT and authentication

CVE-2026-87802 (CVSS 9.1) affects the SRA component when configured for OAuth 2.0 without a JWKS URI set. Without that check, an attacker can forge arbitrary JWTs and impersonate any user in the system. Check your SRA OAuth 2.0 configuration before patching so you know whether this path was open.

CVE-2026-87785 (CVSS 9.1) is an authentication bypass: if an attacker can access the JWKS protocol and key used for internal JWT auth, they can forge valid tokens. Most relevant in environments where Syncope’s internal APIs are exposed to network segments broader than the admin team.

Authorization and privilege

CVE-2026-73668 (CVSS 9.8): any administrator in a Realm can read the full Connector configuration through the REST API, including stored credentials for LDAP directories, Active Directory, and external databases. If Syncope’s admin interface has been accessible to multiple administrators, treat all connector credentials as potentially read.

CVE-2026-73470 (CVSS 9.8): delegation assignments can reference Roles the delegating user does not own, or Realms outside the expected subtree. This breaks the scoping model that limits admin blast radius in multi-tenant Syncope deployments.

What to do

Upgrade to the latest patched release. Each CVE advisory is linked above; visit the Apache Syncope project site for current release download links.

If you need to stage the rollout:

1. Check SRA’s OAuth 2.0 configuration for a JWKS URI (CVE-2026-87802). No JWKS URI means any account can be impersonated with a forged token.
2. Upgrade to fix the search injection paths (CVE-2026-73579, CVE-2026-86460, CVE-2026-82232). These require authenticated access, but service accounts that call the search API are included in that surface.
3. After patching, rotate all credentials stored in Connector objects, especially LDAP bind passwords and database service accounts. CVE-2026-73668 may have exposed those credentials to every administrator who queried the REST API.
4. Audit delegation assignments for Roles or Realms outside expected scope (CVE-2026-73470).

For context on injection risk in Elasticsearch-backed deployments: CVE-2026-72649 in Elasticsearch’s ML module covered last week shows the separate injection exposure in that layer. A Syncope deployment running against an unpatched Elasticsearch instance and carrying CVE-2026-73579 is chained risk. The Apache Tomcat EncryptInterceptor bypass now in CISA KEV is a recent reminder that Apache Foundation projects are active targets.