CVE-2026-77147: Apache Syncope: Groovy Sandbox escape for empty CommandArgs

Apache Syncope contains a code injection vulnerability (CWE-94) in which an administrator holding entitlements over Implementations can define a malicious Groovy Command class whose CommandArgs static implementation contains untrusted code, bypassing the Groovy security sandbox. Successful exploitation executes arbitrary code on the Syncope server with the privileges of the application, giving the attacker full read and write access to managed identity data and potentially broader host compromise. The flaw requires high privileges (a Syncope administrator, not an end user), which limits the attack surface to insider threats, compromised admin accounts, or environments where Implementation rights are delegated too broadly. All Syncope 3.0.0-M0–3.0.16, 4.0.0-M0–4.0.7, and 4.1.0-M0–4.1.2 deployments are affected; there is no evidence of in-the-wild exploitation and no public proof of concept is known.

Do: Upgrade to Apache Syncope 4.0.8 or 4.1.3 immediately; since the 3.0.x line has no listed fix, 3.0.16 and earlier deployments should migrate to 4.0.8+ or 4.1.3+. In the interim, restrict the 'Implementations' entitlement to a minimal set of fully trusted administrators and audit existing Groovy Command and CommandArgs implementations for unexpected or recently added code. Review Syncope admin and audit logs for suspicious Implementation creation events, especially if admin credentials are shared or delegated to multiple operators.