CVE-2026-86460 in Syncope
Summary
by MITRE • 09/14/2026
Cypher injection vulnerability in the Neo4j persistence layer when processing some FIQL search conditions.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2.
Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/14/2026
Apache Syncope versions ranging from 3.0.0-M0 through 3.0.16 and from 4.0.0-M0 through 4.0.7, as well as the 4.1.x series up to version 4.1.2, are susceptible to a critical Cypher injection vulnerability within their persistence layer. This security flaw is specifically triggered when the application processes Filtered Inquiry Query Language FIQL search conditions. The underlying mechanism involves the improper neutralization of special elements used in Cypher queries before they are incorporated into database commands. When user-supplied input from FIQL filters is not adequately sanitized or parameterized, it allows an attacker to inject malicious Cypher code that alters the intended logic of the query executed against the Neo4j graph database backend.
The technical nature of this vulnerability aligns with CWE-94 Improper Control of Generation of Code SQL Injection and more specifically CWE-1053 Construction of Query Using Unsanitized Input in a NoSQL context, adapted for graph databases. In practice, an attacker can manipulate the FIQL filter parameters to break out of the expected query structure. By injecting specific Cypher syntax fragments, such as clause modifiers or node relationship traversals, the malicious input bypasses authentication checks or retrieves sensitive data that should remain inaccessible. This exploitation path is particularly dangerous because it targets a core functionality used for identity and access management queries, potentially allowing unauthorized enumeration of user attributes, roles, or organizational structures stored within the Neo4j instance.
From an operational perspective, this vulnerability poses severe risks to the confidentiality and integrity of the data managed by Apache Syncope. Successful exploitation could lead to full database compromise, including the extraction of hashed passwords, personal identifiable information, and administrative credentials. Furthermore, depending on the configuration and permissions granted to the Neo4j user account used by Syncope, an attacker might execute destructive commands that modify or delete identity records, leading to service disruption or privilege escalation within the broader IT infrastructure. The impact is compounded by the fact that FIQL filters are often exposed through REST APIs, making them accessible over network boundaries if not properly secured behind additional authentication layers.
This attack vector corresponds to MITRE ATT&CK technique T1059 Command and Scripting Interpreter with a focus on database query injection patterns similar to T1190 Exploit Public-Facing Application. The attacker leverages the application's own input validation logic as a vehicle for code execution within the data layer, effectively turning a search feature into an administrative tool. This bypasses traditional web application firewalls that may not inspect graph-specific syntax or parameterized query structures deeply enough to detect injected Cypher commands embedded in standard filter parameters.
To mitigate this vulnerability and prevent further exploitation, organizations must immediately upgrade Apache Syncope to version 4.0.8 for the 4.0.x branch or version 4.1.3 for the 4.1.x branch. These releases contain patches that properly sanitize input from FIQL filters before they are passed to the Neo4j persistence layer, ensuring that user-supplied data is treated strictly as literal values rather than executable code components. In addition to upgrading, administrators should enforce strict input validation on all API endpoints and ensure that the database account used by Syncope adheres to the principle of least privilege, limiting write access where only read operations are required for identity lookups. Regular security audits and penetration testing focused on NoSQL injection vectors are also recommended to identify any residual risks in custom integrations or extended configurations.