CVE-2026-42797
Exposure of Sensitive Information Through Data Queries vulnerability in Apache Syncope. An administrator with adequate entitlements for Derived Schemas can create a malicious JEXL expression which allows any administrator with sufficient entitlements for User read to access User-related security-sensitive information. This issue affects Apache Syncope: 3.0 through 3.0.16, 4.0 through 4.0.5, 4.1.0. Users are recommended to upgrade to version 4.0.6 / 4.1.1, which fix this issue by further restricting the JEXL expression definition.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 4.9
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- EPSS probability
- 0.44%
- CWE
- CWE-202
- Published
- 2026-05-25
- Last modified
- 2026-05-26
Affected products
- Apache Software Foundation Apache Syncope
- Apache Software Foundation Apache Syncope
- Apache Software Foundation Apache Syncope
Weakness type
Related vulnerabilities
- CVE-2026-16520 — Improper input validation and Exposure of sensitive information through data queries vulnerability...
- CVE-2026-25703 — Potential information leakage from manager /network/graph API in NeuVector
- CVE-2026-70473 — Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history
- CVE-2026-40245 — Free5GC: UDR nudr-dr influenceData/subs-to-notify leaks SUPI in error response body without authentication
- CVE-2026-30778 — Apache SkyWalking: The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL.
- CVE-2026-33530 — InvenTree Vulnerable to ORM Filter Injection
- CVE-2026-3546 — e-shot <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via API Token via 'eshot_form_builder_get_account_data' AJAX Action
- CVE-2026-25050 — Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy