Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-77883— Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist

Quick assessment

Affected

Apache Software Foundation Apache Syncope

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Apache Syncope是美国Apache基金会的一款集中管理用户身份、权限及访问策略的企业级身份治理平台。 Apache Syncope 3.0.0-M0版本至3.0.16版本、4.0.0-M0版本至4.0.7版本和4.1.0-M0版本至4.1.2版本存在信息泄露漏洞，该漏洞源于数据查询处理不当，具有Derived Schemas权限的管理员可创建恶意JEXL表达式，可能导致具有User read权限的管理员访问LinkedAccount（如存在）或Manager（如定义）的敏感信息，可能包括散列凭

AI Predicted 6.5 Difficulty: Moderate EPSS 0.39% · P33 Updated Sep 15, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 3

Vendor	Product	Version Range	Status
Apache Software Foundation	Apache Syncope	`3.0.0-M0≤ 3.0.16`	affected
		`4.0.0-M0≤ 4.0.7`	affected
		`4.1.0-M0≤ 4.1.2`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-77883

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist

Source: CVE Program / CVE List V5

Vulnerability Description

Exposure of sensitive information through data queries vulnerability in Apache Syncope. An administrator with adequate entitlements for Derived Schemas can create a malicious JEXL expression which allows any administrator with sufficient entitlements for User read to access LinkedAccount's (if present) or Manager's (if defined) sensitive information, possibly including hashed credentials. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

通过数据查询的敏感数据暴露

Source: CVE Program / CVE List V5

Vulnerability Title

Apache Syncope 信息泄露漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Apache Software Foundation	Apache Syncope	3.0.0-M0 ~ 3.0.16	-

II. Public POCs for CVE-2026-77883

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-77883

请登录查看更多情报信息。

Mailing List Discussions for CVE-2026-77883 (1)

🔗 CVE-2026-77883: Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist-Apache Mail Archives vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-77883

Same Patch Batch · Apache Software Foundation · 2026-09-14 · 39 CVEs total

CVE-2026-82434	10.0 CRITICAL	Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential
CVE-2026-78330		Apache Syncope: Privilege escalation for admin user via JWT authentication
CVE-2026-73470		Apache Syncope: Delegating users can grant unowned Roles
CVE-2026-73579		Apache Syncope: Non-recursive Any search could skip Realms restrictions
CVE-2026-75015		Apache Syncope: Nested secrets leak cleartext into audit records readable
CVE-2026-75030		Apache Syncope: Incomplete authorization checks for Group members deprovisioning
CVE-2026-77051		Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search
CVE-2026-73668		Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values
CVE-2026-77147		Apache Syncope: Groovy Sandbox escape for empty CommandArgs
CVE-2026-77181		Apache Syncope: ClientApp update entitlement not effective
CVE-2026-78318		Apache Syncope: Unauthenticated reflected XSS in Console and Enduser
CVE-2026-73178		Apache Syncope: JWT Access Token takeover
CVE-2026-78336		Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user
CVE-2026-82232		Apache Syncope: SQL injection via sort parameter in Task search
CVE-2026-86460		Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence
CVE-2026-87779		Apache Syncope: AES Secret Key disclosure via log output
CVE-2026-87785		Apache Syncope: JWT subject spoofing
CVE-2026-87802		Apache Syncope: SRA OAuth2 JWT signature verification bypass
CVE-2026-68570		Apache Doris: Authorization bypass leading to unauthorized data access
CVE-2026-72524		Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitr

Showing top 20 of 39 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Apache Syncope

Same vendor: Apache Software Foundation

Same weakness: CWE-202