Description

Cypher injection vulnerability in the Neo4j persistence layer when processing some FIQL search conditions. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-14T11:17:05.250Z",
  "pubdate": "2026-09-14T11:17:05.250Z",
  "executiveSummary": "Apache Syncope contains a critical Cypher injection vulnerability within its Neo4j persistence layer. The vulnerability stems from improper sanitization of FIQL (Feed Item Query Language) search conditions before they are translated into Cypher queries for the underlying graph database.\nThis injection flaw allows an attacker to manipulate the structure of generated Cypher statements, potentially enabling unauthorized data retrieval, modification, or deletion within the Neo4j instance. The impact is significant, as it threatens the confidentiality, integrity, and availability of the managed data.\nThe vulnerability affects Apache Syncope versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Exploitation does not necessarily require highly sophisticated techniques but relies on the ability to pass malicious input through affected API search parameters. Users are strongly advised to upgrade to the patched versions to eliminate this attack vector.",
  "technicalDetails": "The vulnerability is situated in the persistence layer of Apache Syncope, specifically where the framework maps FIQL search conditions to Neo4j Cypher queries. FIQL is a structured language for defining filters, and the persistence engine is responsible for parsing these strings and generating corresponding Cypher statements to interact with the Neo4j backend.\nThe root cause is a failure to properly sanitize or parameterize user-supplied input contained within FIQL search filters. When the system processes these search conditions, it constructs Cypher queries by concatenating input strings directly into the query template rather than using parameterized queries or a secure query builder API. This creates a classic injection vulnerability pattern where the user input is interpreted by the Neo4j engine as part of the command structure rather than data.\nExploitation follows a specific attack flow: First, an attacker identifies an endpoint in Apache Syncope that accepts FIQL search conditions. Second, the attacker crafts a malicious FIQL payload designed to terminate the intended query clause prematurely and inject arbitrary Cypher commands. By using characters like quotes, semicolons, or Cypher-specific operators (such as 'MATCH', 'WHERE', 'WITH', 'CALL', or 'DETACH DELETE'), the attacker can manipulate the execution context of the database query.\nWhen the server processes this crafted FIQL, the underlying persistence layer generates a modified Cypher statement. For example, if a search expects a user name, an attacker could supply a payload that includes '...\" OR 1=1 WITH n MATCH (x) RETURN x...'. When executed, the Neo4j instance evaluates the injected Cypher commands, allowing the attacker to bypass access controls or perform unauthorized operations.\nThe scope of impact depends on the permissions granted to the service account running the Neo4j instance. A successful injection can lead to unauthorized access to sensitive identity information, bypass of authentication mechanisms, or administrative actions such as clearing nodes or altering graph topology. The vulnerability is exploitable via any network-accessible endpoint that accepts FIQL input, potentially without requiring complex authentication bypass, depending on the specific search endpoint exposed."
}