Apache Syncope search injection via FIQL to SQL/Neo4j/Elasticsearch
Incorrect authorization in Apache Syncope allows search requests to be injected into SQL, Neo4j, or Elasticsearch/OpenSearch backends. Any authenticated user with search access can execute arbitrary queries against the configured persistence layer.
- Vendor
- Apache
- Product
- Syncope
- CVSS
- 9.8
- EPSS (exploit probability)
- 0.5%
- Status
- patched
- Published
Apache Syncope’s search API transforms user-supplied FIQL (Feed Item Query Language) conditions into queries for whichever persistence backend the deployment uses: SQL, Neo4j, or Elasticsearch/OpenSearch. Insufficient sanitization in that transformation allows any authenticated user with search access to inject arbitrary commands into the database layer.
The impact depends on which backend is configured. SQL deployments are exposed to SQL injection; Neo4j deployments to Cypher injection (also tracked separately as CVE-2026-86460); Elasticsearch/OpenSearch deployments to search query injection.
The Apache Software Foundation released a patch via the advisory on the Apache security mailing list. Upgrade to the latest Syncope release and review which service accounts or internal applications have search access.
