Loading vulnerability…
Information Disclosure via Malicious JEXL Expressions in Apache Syncope
CVE-2026-42797 is an information disclosure vulnerability in Apache Syncope affecting the syncope-core-provisioning-api component. The flaw arises from insufficient restriction of JEXL expressions used in Derived Schemas. An administrator with entitlements sufficient to manage Derived Schemas can define a malicious JEXL expression that is later evaluated in a way that exposes user-related security-sensitive information to another administrator who has User read entitlements. Affected versions are Apache Syncope 3.0 through 3.0.16, 4.0 through 4.0.5, and 4.1.0. The issue was fixed by further restricting JEXL expression definition in versions 4.0.6 and 4.1.1.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables unauthorized disclosure of sensitive user-related information within the Syncope administrative context. The vulnerability does not describe direct code execution or privilege escalation, but it breaks intended data access boundaries by allowing crafted schema logic to expose security-sensitive fields during user data reads. This can result in confidentiality loss affecting identity and access management data handled by the platform.
If you can’t patch tonight, do this now.
Until upgrades can be applied, tightly restrict which administrators are allowed to create or modify Derived Schemas and review existing Derived Schema JEXL expressions for unsafe or unnecessary access to user attributes. Limit User read entitlements to only those roles that require them, apply separation of duties between schema management and user data access, and audit administrative changes involving schema definitions and expression-based data derivation.
Patch, then assume compromise.
Upgrade Apache Syncope to version 4.0.6 or 4.1.1, or later patched releases in the supported branch. The fix further restricts JEXL expression definitions to prevent malicious Derived Schema expressions from exposing sensitive user information. Where applicable, rebuild or redeploy from patched source or binaries corresponding to the fixed release.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.