Apache Syncope RCE via Groovy sandbox bypass
Administrator can create malicious Groovy class to run untrusted code on separate thread.
50
Vulnerability5 · 5 reads
CVE-2026-113687
RCE via Groovy sandbox bypass in Apache Syncope
- CVSS 3.1
- 9.8 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache Syncope has a vulnerability in its Groovy security sandbox due to improper isolation. An administrator can create a malicious Groovy class that runs untrusted code on a separate Thread, bypassing the sandbox and leading to remote code execution. This affects versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, and 4.1.0-M0 through 4.1.3.
What to do: Upgrade to Apache Syncope 4.0.9 or 4.1.4.
| Product | Affected | Fixed in |
|---|---|---|
| Apache Syncope | 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, 4.1.0-M0 through 4.1.3 | 4.0.9, 4.1.4 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Improper isolation or compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class running untrusted code on a separate Thread, thus bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3. Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.
- Weakness
- CWE-653
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H