PT-2026-43079 · Apache · Apache Syncope

Elin Kai · CVE-2026-42797 · Published 2026-05-25 · Updated 2026-05-29

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Syncope versions 3.0 through 3.0.16 Apache Syncope versions 4.0 through 4.0.5 Apache Syncope version 4.1.0

Description An administrator with adequate entitlements for Derived Schemas can create a malicious JEXL (Java Expression Language) expression. This allows any administrator with sufficient entitlements for User read to access security-sensitive information related to users.

Recommendations For versions 3.0 through 3.0.16, 4.0 through 4.0.5, and 4.1.0, upgrade to version 4.0.6 or 4.1.1.

Exploit

Fix

Weakness Enumeration

CWE-202

Related Identifiers

CVE-2026-42797

GHSA-VR35-JM2F-8WG2

Affected Products

Apache Syncope

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42797.json · Exploit
• https://osv.dev/vulnerability/GHSA-vr35-jm2f-8wg2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42797 · Security Note
• https://lists.apache.org/thread/5y7d277sntyytrmxnx2tfjr9ftcpq1s6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-42797 · Vendor Advisory
• https://github.com/apache/syncope · Note
• https://t.me/cveNotify/164757 · Telegram Post
• http://openwall.com/lists/oss-security/2026/05/25/5 · Note
• https://t.me/CVEtracker/54882 · Telegram Post
• https://twitter.com/dailycve/status/2060188586087989513 · Twitter Post
• https://repo.maven.apache.org/maven2 · Note
• https://twitter.com/oss_security/status/2059122685070721095 · Twitter Post