Apache Syncope Patches Critical RCE, SQL Injection, and Privilege Escalation Flaws

Apache released security updates for its Syncope identity and access management platform to fix multiple vulnerabilities across the 3.0, 4.0, and 4.1 branches, including remote code execution, SQL injection, privilege escalation, SSRF, information disclosure, XXE, XSS, and cryptographic weaknesses. The most severe issues include several Groovy-related post-authentication RCE flaws, while CVE-2026-57308 affects Audit Events search through an unsanitized sort parameter that can enable authenticated SQL injection, and CVE-2026-62183 can let a regular user elevate privileges through certain self-service workflow configurations and obtain administrator-level entitlements.

Affected releases include Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1 for the newly disclosed SQL injection and privilege escalation bugs, with Apache delivering fixes in versions 4.0.7 and 4.1.2 and noting that some older flaws were addressed in earlier point releases such as 4.1.1, 4.0.6, 4.0.4, 4.0.3, 3.0.16, and 3.0.15. Apache said binary hotfixes are not available, requiring organizations to upgrade or rebuild from patched source, and urged administrators to review roles, entitlements, and self-service workflows; no public exploitation has been confirmed.