Apache Syncope search injection via FIQL to SQL/Neo4j/Elasticsearch
Incorrect authorization in Apache Syncope allows search requests to be injected into SQL, Neo4j, or Elasticsearch/OpenSearch backends. Any authenticated user with search access can execute arbitrary queries against the configured persistence layer.
- Vendor
- Apache
- Product
- Syncope
- CVSS
- 9.8
- EPSS (exploit probability)
- 0.5%
- Status
- patched
- Published
Is CVE-2026-73579 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-73579 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-11 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.5% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-11. Full cross-catalog view: /kev-comparison
CVE-2026-73579 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
Apache Syncope’s search API transforms user-supplied FIQL (Feed Item Query Language) conditions into queries for whichever persistence backend the deployment uses: SQL, Neo4j, or Elasticsearch/OpenSearch. Insufficient sanitization in that transformation allows any authenticated user with search access to inject arbitrary commands into the database layer.
The impact depends on which backend is configured. SQL deployments are exposed to SQL injection; Neo4j deployments to Cypher injection (also tracked separately as CVE-2026-86460); Elasticsearch/OpenSearch deployments to search query injection.
The Apache Software Foundation released a patch via the advisory on the Apache security mailing list. Upgrade to the latest Syncope release and review which service accounts or internal applications have search access.
Other Apache CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2016-3081 Apache Struts Command Injection Vulnerability | [ HIGH ] | 8.1 | 96.9% | |
| CVE-2026-87802 Apache Syncope SRA allows JWT forgery without JWKS URIwrite-up | [ CRITICAL ] | 9.1 | 0.3% | — |
| CVE-2026-87785 Apache Syncope JWT authentication bypass via JWKS spoofingwrite-up | [ CRITICAL ] | 9.1 | 0.5% | — |
| CVE-2026-86460 Apache Syncope Cypher injection via Neo4j FIQL searchwrite-up | [ CRITICAL ] | 9.8 | 0.6% | — |
| CVE-2026-82232 Apache Syncope admin-level SQL injectionwrite-up | [ CRITICAL ] | 9.8 | 0.6% | — |
| CVE-2026-73668 Apache Syncope admin REST API exposes connector credentialswrite-up | [ CRITICAL ] | 9.8 | 0.5% | — |
| CVE-2026-73470 Apache Syncope improper privilege management in delegationswrite-up | [ CRITICAL ] | 9.8 | 0.5% | — |
| CVE-2026-34486 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability | [ HIGH ] | 7.5 | 98.5% |
