CVE-2026-114364 exposes an SQL injection flaw in Apache Syncope’s Audit Events search feature. Unvalidated values supplied through the opEvent parameter allow an attacker who has sufficient administrative entitlements to inject arbitrary SQL commands via stacked queries. This vulnerability, identified as CWE‑89, can enable data exfiltration, manipulation, or potentially execution of arbitrary code on the database server if the underlying system privileges permit.

Affected releases span multiple major lines of Apache Syncope. Versions from 3.0.0‑M0 through 3.0.16, from 4.0.0‑M0 through 4.0.8, and from 4.1.0‑M0 through 4.1.3 are vulnerable. An administrator should verify the current Patch version and plan to move to a fixed release.

The CVSS score is not provided, and EPSS is unavailable, indicating no real‑world exploitation data at this time. The flaw is not in CISA’s KEV catalog. Attackers would need authenticated access to the search API with appropriate privileges, making the threat surface limited to privileged users. Nonetheless, because the flaw permits arbitrary SQL execution, the potential impact warrants prompt remediation.