Apache Syncope Cypher injection via Neo4j FIQL search
Cypher injection in Apache Syncope's Neo4j persistence layer via FIQL search conditions. Affects 3.0.0-M0 through 3.0.16 and the 4.x branch. Authenticated attackers with search access can inject arbitrary Cypher queries.
- Vendor
- Apache
- Product
- Syncope
- CVSS
- 9.8
- EPSS (exploit probability)
- 0.6%
- Status
- patched
- Published
When Apache Syncope is deployed with a Neo4j persistence backend, FIQL (Feed Item Query Language) search conditions are passed into the Cypher query engine without adequate sanitization. An authenticated user with search access can inject arbitrary Cypher statements.
Affected versions span 3.0.0-M0 through 3.0.16 and the 4.x branch. The broader search injection issue affecting all backends is tracked as CVE-2026-73579; this CVE specifically covers the Neo4j/Cypher layer.
The Apache Software Foundation released a patch. See the advisory and the Apache Syncope patch article for patch priority guidance.
