CVE-2026-77883

🗓️ 14 Sep 2026 12:30:53Reported by MendType

Administrator exposure of sensitive information in Apache Syncope via malicious JEXL.

Reporter	Title	Published	Views	Family All 12
CVE	CVE-2026-77883	14 Sep 202612:30	–	cve
Cvelist	CVE-2026-77883 Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist	14 Sep 202612:30	–	cvelist
EUVD	EUVD-2026-77441	14 Sep 202612:30	–	euvd
NVD	CVE-2026-77883	14 Sep 202613:18	–	nvd
Positive Technologies	PT-2026-91178	14 Sep 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-77883: Exposure of Sensitive Information Through Data Queries	14 Sep 202600:00	–	rapid7
Snyk	Information Exposure	14 Sep 202614:24	–	snyk
vulnersOsv	org.apache.syncope.core.am:syncope-core-am-logic (>=3.0.0-m0, <=4.0.7), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=3.0.0-m0, <=4.0.7) +43 more potentially affected by CVE-2026-77883 via org.apache.syncope.core:syncope-core-provisioning-api (>=3.0.0-m0, <=4.0.7)	14 Sep 202614:24	–	vulnersosv
vulnersOsv	org.apache.syncope.core.am:syncope-core-am-logic (>=4.0.0-m0, <=4.0.7), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.0.0-m0, <=4.0.7) +36 more potentially affected by CVE-2026-77883 via org.apache.syncope.core:syncope-core-provisioning-api (>=4.0.0-m0, <=4.0.7)	14 Sep 202612:30	–	vulnersosv
vulnersOsv	org.apache.syncope.core.am:syncope-core-am-logic (>=4.1.0-m0, <=4.1.2), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.1.0-m0, <=4.1.2) +36 more potentially affected by CVE-2026-77883 via org.apache.syncope.core:syncope-core-provisioning-api (>=4.1.0-m0, <=4.1.2)	14 Sep 202612:30	–	vulnersosv