CVE-2026-77147: Apache Syncope: Groovy Sandbox escape for empty CommandArgs
Apache Syncope patches an important Groovy sandbox escape (CVE-2026-77147) allowing administrators to achieve code injection via empty CommandArgs.
CVE-2026-77147 is an important-severity improper control of code generation vulnerability in Apache Syncope, rated as a Groovy sandbox escape for empty CommandArgs. An administrator with adequate privileges can exploit the flaw to achieve code injection. Affected versions include syncope-core-spring 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.
- Groovy sandbox escape via empty CommandArgs in Apache Syncope
- Rated important severity, enables code injection
- Requires an administrator with adequate privileges
- Affects 3.0.x, 4.0.x, and 4.1.x release lines
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-77147 | Groovy Sandbox Escape Allows Code Injection in Apache Syncope | 6.5 | — |
From the original article
Posted by Francesco Chicchiriccò on Sep 14 Severity: important Affected versions: - Apache Syncope (org. apache. syncope.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.