CVE-2026-42797

Apache Syncope versions 3.0 through 3.0.16 , 4.0 through 4.0.5 , and 4.1.0 are vulnerable to an Exposure of Sensitive Information Through Data Queries vulnerability. The root cause is that an administrator with entitlements for Derived Schemas can create a malicious JEXL expression . This allows ...