CVE-2026-77883

MediumCVSS 4.9/10Last modified Sep 14, 2026

Description

Exposure of sensitive information through data queries vulnerability in Apache Syncope.

An administrator with adequate entitlements for Derived Schemas can create a malicious JEXL expression which allows any administrator with sufficient entitlements for User read to access LinkedAccount's (if present) or Manager's (if defined) sensitive information, possibly including hashed credentials.

This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2.

Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-202

Affected software

No affected versions have been published.

Timeline

Published
Sep 14, 2026
Last modified
Sep 14, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-778847.1Gallery - Private Photo Vault 1.0.41 starts an unauthenticated HTTP server that is reachable from the local network. The server listens on TCVE-2026-778867.5Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to deny service over a network.CVE-2026-778876.4Out-of-bounds read in Windows DHCP Server allows an authorized attacker to execute code locally.CVE-2026-778887.5Access of resource using incompatible type ('type confusion') in Windows DHCP Server allows an unauthorized attacker to deny service over a CVE-2026-778897.5Access of resource using incompatible type ('type confusion') in Windows DHCP Server allows an unauthorized attacker to deny service over a CVE-2026-778907.5Access of resource using incompatible type ('type confusion') in Windows DHCP Server allows an unauthorized attacker to deny service over a CVE-2026-778916.4Out-of-bounds read in Windows DHCP Server allows an authorized attacker to execute code locally.CVE-2026-778926.8No cwe for this issue in Windows Boot Manager allows an unauthorized attacker to elevate privileges with a physical attack.CVE-2026-778937.5Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to deny service over a network.CVE-2026-778947.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attackCVE-2026-778957.5Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to deny service over a network.CVE-2026-778967.5Integer overflow or wraparound in Remote Desktop Client allows an unauthorized attacker to deny service over a network.
CVE-2026-77883: Medium severity, CVSS 4.9 | Vulnix