CVE-2026-42797— Apache Syncope: JexlContextBuilder Information Disclosure
Quick assessment
Affected
Apache Software Foundation Apache Syncope
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Syncope是美国阿帕奇（Apache）基金会的一套用于企业环境中的开源数字身份管理系统。该系统支持身份管理、角色配置等。 Apache Syncope 3.0版本至3.0.16版本、4.0版本至4.0.5版本和4.1.0版本存在安全漏洞，该漏洞源于通过数据查询暴露敏感信息，可能导致具有足够权限的管理员创建恶意JEXL表达式，从而访问用户相关的安全敏感信息。
Possible ATT&CK Techniques 1 AI
T1005 · Data from Local SystemAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache Syncope | 3.0≤ 3.0.16 |
affected |
4.0≤ 4.0.5 |
affected | ||
4.1≤ 4.1.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-42797
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Syncope: JexlContextBuilder Information Disclosure
Source: CVE Program / CVE List V5
Vulnerability Description
Exposure of Sensitive Information Through Data Queries vulnerability in Apache Syncope.
An administrator with adequate entitlements for Derived Schemas can create a malicious JEXL expression which allows any administrator with sufficient entitlements for User read to access User-related security-sensitive information.
This issue affects Apache Syncope: 3.0 through 3.0.16, 4.0 through 4.0.5, 4.1.0.
Users are recommended to upgrade to version 4.0.6 / 4.1.1, which fix this issue by further restricting the JEXL expression definition.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
通过数据查询的敏感数据暴露
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Syncope 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Syncope是美国阿帕奇（Apache）基金会的一套用于企业环境中的开源数字身份管理系统。该系统支持身份管理、角色配置等。 Apache Syncope 3.0版本至3.0.16版本、4.0版本至4.0.5版本和4.1.0版本存在安全漏洞，该漏洞源于通过数据查询暴露敏感信息，可能导致具有足够权限的管理员创建恶意JEXL表达式，从而访问用户相关的安全敏感信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Syncope | 3.0 ~ 3.0.16 | - |
|
II. Public POCs for CVE-2026-42797
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-42797
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-42797 (1)
Same Patch Batch · Apache Software Foundation · 2026-05-25 · 9 CVEs total
| CVE-2026-48589 | Apache Shiro: Jakarta EE open redirect via untrusted Referer in post-login redirect flow | |
| CVE-2026-44598 | Apache Shiro Jakarta EE module: Open redirect and SSRF (requires valid credentials) | |
| CVE-2026-43828 | Apache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by | |
| CVE-2026-43827 | Apache Shiro: Session fixation: new session is not created after login by default | |
| CVE-2026-42782 | Apache Syncope: Post-auth RCE via Groovy static | |
| CVE-2026-46745 | Apache Airflow FAB provider: LDAP Filter Injection in FAB Auth Manager _search_ldap reacha | |
| CVE-2026-45361 | Apache Airflow Google provider: SSH host key verification disabled in ComputeEngineSSHHook | |
| CVE-2026-45249 | Apache ECharts: XSS in Lines series tooltip rendering |
IV. Related Vulnerabilities
Same product: Apache Syncope
-
CVE-2026-73191
Apache Syncope: CAS service URL injection via Forwarded HTTP -
CVE-2026-73195
Apache Syncope: CSV export spreadsheet formula injection -
CVE-2026-73236
Apache Syncope: Cross-Realm authorization bypass in delegate -
CVE-2026-73370
Apache Syncope: Cross-Realm boundaries reconciliation bypass -
CVE-2026-73178
Apache Syncope: JWT Access Token takeover
Same vendor: Apache Software Foundation
-
CVE-2026-102795
Apache Traffic Server: SNI to Host header matching policy is -
CVE-2026-59265
Apache OpenOffice, Apache OpenOffice: Opening a malicious do -
CVE-2026-66054
Apache Thrift: C++ THeaderTransport does not enforce configu -
CVE-2026-61374
Apache Thrift: Java TSaslTransport post-auth data-frame miss -
CVE-2026-63772
Apache Thrift: Unauthenticated single-packet crash of Go Thr
Same weakness: CWE-202
-
CVE-2026-103440
pagetriagelist discloses suppressed reviewer usernames -
CVE-2026-40533
群晖DSM 7.x敏感信息泄露漏洞 -
CVE-2026-77883
Apache Syncope: Information disclosure via one-hop JEXL navi -
CVE-2026-30778
Apache SkyWalking: The SkyWalking OAP /debugging/config/dump -
CVE-2026-33530
InvenTree Vulnerable to ORM Filter Injection
V. Comments for CVE-2026-42797
No comments yet