CVE-2026-42797
Apache Syncope 3.0.0 – 3.0.16
Raw vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NSummary
CVE-2026-42797 is a medium-severity Exposure of Sensitive Information Through Data Queries (CWE-202) vulnerability in Apache Syncope. Its CVSS base score is 4.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Information Repositories (T1213); ranked at the 36th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-31702
Vulnerability Data
Exposure of Sensitive Information Through Data Queries vulnerability in Apache Syncope. An administrator with adequate entitlements for Derived Schemas can create a malicious JEXL expression which allows any administrator with sufficient entitlements for User read to access User-related security-sensitive information.…
more
This issue affects Apache Syncope: 3.0 through 3.0.16, 4.0 through 4.0.5, 4.1.0. Users are recommended to upgrade to version 4.0.6 / 4.1.1, which fix this issue by further restricting the JEXL expression definition.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables unauthorized access to security-sensitive user data via malicious expressions in queries, mapping to data repository access and account discovery.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces access restrictions so that even an admin who can define Derived Schemas cannot expose User security-sensitive attributes to other read-entitled users.
Requires validation of JEXL expressions supplied for Derived Schemas, blocking the malicious expressions that cause unintended sensitive-data exposure.
Enforces information-flow rules between schema definitions and User data retrieval, limiting leakage of attributes that should remain protected.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Least-privilege query permissions directly limit the data an attacker can request or infer.
Behavior analytics on query activity can detect inference attempts but does not prevent exposure at query time.
Protecting data-in-use reduces what remains available for inference via queries.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Access control limits who can run queries that could expose sensitive information via inference.
Granular access rights reduce the ability of users to craft inference queries.
Data masking prevents inference by obscuring sensitive values returned in query results.
Information access restriction directly limits query scope that could lead to inference.
Classification helps identify sensitive data that must be protected from inference attacks.
DLP can detect and block queries or result sets that risk exposing sensitive information.