Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitymedium

Apache Syncope RCE via Groovy sandbox bypass

Original title: CVE-2026-113687: Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypass

oss-security ()1
Read at seclists.org
Part of a story covered by 5 sourcesApache Syncope vulnerabilities enable RCE, bypasses and escalationMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Administrator can create malicious Groovy class to run untrusted code on separate thread.

Apache Syncope has a vulnerability where an administrator with adequate entitlements can create a malicious Groovy class that runs untrusted code on a separate thread, bypassing the Groovy security sandbox. This allows remote code execution. The issue affects the same versions as CVE-2026-114364.

Key facts
  • Severity: important
  • Affects 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, 4.1.0-M0 through 4.1.3
  • Bypasses Implementations entitlements
Security assessment · AI, from the articleNo known exploitation

Impact: remote code execution

Analyze CVE-2026-113687 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-113687
Tags
apachesyncopegroovyrce
Vendors
Apache
Products
Syncope

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-113687
RCE via Groovy sandbox bypass in Apache Syncope
9.8—

From the original article

Posted by Francesco Chicchiriccò on Nov 02 Severity: important Affected versions: - Apache Syncope 3. 0. 0-M0 through 3.

oss-security

seclists.org

Read the full article at oss-security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.