CVE-2026-42797

The record

Exposure of Sensitive Information Through Data Queries vulnerability in Apache Syncope. An administrator with adequate entitlements for Derived Schemas can create a malicious JEXL expression which allows any administrator with sufficient entitlements for User read to access User-related security-sensitive information. This issue affects Apache Syncope: 3.0 through 3.0.16, 4.0 through 4.0.5, 4.1.0. Users are recommended to upgrade to version 4.0.6 / 4.1.1, which fix this issue by further restricting the JEXL expression definition.

Affected packages

Related vulnerabilities

• CVE-2026-16520 Improper input validation and Exposure of sensitive information through data queries… CWE-202
• CVE-2026-25703 NeuVector through 5.4.9 is can potentially leak information from manager /network/graph… CWE-202
• CVE-2026-70473 Flowise is a drag-and-drop user interface for building customized large language model… CWE-202
• CVE-2026-40245 Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core… CWE-202
• CVE-2026-30778 The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration… CWE-202
• CVE-2026-33530 InvenTree is an Open Source Inventory Management System. CWE-202
• CVE-2026-3546 The e-shot form builder plugin for WordPress is vulnerable to Sensitive Information… CWE-202
• GHSA-6497-prx7-gpmq geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclosure CWE-202