Description

Exposure of sensitive information through data queries vulnerability in Apache Syncope. An administrator with adequate entitlements for Derived Schemas can create a malicious JEXL expression which allows any administrator with sufficient entitlements for User read to access LinkedAccount's (if present) or Manager's (if defined) sensitive information, possibly including hashed credentials. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-09-14T13:18:46.740Z",
  "pubdate": "2026-09-14T13:18:46.740Z",
  "executiveSummary": "Apache Syncope is susceptible to an exposure of sensitive information via malicious JEXL (Java Expression Language) expressions within Derived Schemas.\nThe vulnerability allows an authenticated administrator with entitlements for Derived Schema management to craft expressions that bypass authorization controls, enabling the unauthorized retrieval of sensitive data from LinkedAccount or Manager objects.\nThis impacts Apache Syncope versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.\nThe risk implication is significant as it facilitates the potential exfiltration of hashed credentials or other sensitive user attributes by an attacker who already possesses administrative privileges for schema configuration.\nExploitation requires an attacker to have, or gain, specific entitlements for managing Derived Schemas and leverages the JEXL evaluation engine to traverse the object graph, accessing restricted data domains intended to be isolated from the standard User read operation.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper sanitization and sandboxing of JEXL expressions defined within the Derived Schema framework of Apache Syncope.\nDerived Schemas in Apache Syncope allow administrators to define logic for calculating attribute values dynamically. When these expressions are evaluated using the JEXL engine, the system fails to adequately restrict the scope of the expression's execution context.\nAn administrator with the authority to define Derived Schemas can craft a malicious payload containing JEXL syntax designed to access objects and methods outside of the intended scope of a standard User read operation. Specifically, the JEXL expression can be leveraged to navigate the object model and access LinkedAccount or Manager structures.\nThe attack flow proceeds as follows: First, the malicious administrator defines or modifies a Derived Schema, injecting a JEXL expression specifically designed to access non-permitted properties or associated objects. Second, when the system or another administrator performs a read operation that triggers the evaluation of this Derived Schema, the JEXL engine executes the malicious payload within the server-side context.\nBy manipulating the expression to traverse the object graph, the attacker can force the system to return sensitive data—such as hashed credentials—that would otherwise be inaccessible under normal read entitlement constraints. This effectively constitutes a privilege escalation and unauthorized data access path enabled by the underlying expression evaluation engine.\nThis vulnerability specifically affects the Derived Schema functionality. The requirement for 'adequate entitlements for Derived Schemas' indicates that the attack is an abuse of functionality by an authenticated user, rather than an unauthenticated remote execution. However, the impact is severe because it circumvents the expected security boundary between the schema definition layer and the data retrieval layer, allowing for the exposure of sensitive internal data structures.\nAffected versions include 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. The exploitation occurs server-side during the processing of these expressions, rendering the data exposure global to the application's user base if the derived attribute is globally applicable."
}