CVE-2026-82232 is an SQL injection vulnerability in Apache Syncope affecting multiple version ranges. The flaw arises from improper neutralization of special elements in SQL commands, specifically through unsanitized sort clauses used in Task search functionality. An administrator with appropriate entitlements can exploit this to execute arbitrary SQL via stacked queries. The vulnerability is present in Apache Syncope versions from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. The vendor has fixed the issue in versions 4.0.8 and 4.1.3.

Successful exploitation allows an administrator to execute arbitrary SQL commands, potentially leading to full compromise of the underlying database, including data confidentiality, integrity, and availability impacts. The CVSS v3.1 base score is 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges required beyond administrator entitlements, and full impact on confidentiality, integrity, and availability.

Users should upgrade Apache Syncope to version 4.0.8 or 4.1.3, where this SQL injection vulnerability has been fixed. No other mitigations are indicated. Patch status is confirmed by the vendor's advisory recommending these versions.