Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitymedium

Apache Syncope remote code execution via Flowable JUEL expression (CVE-2026-109083)

Original title: CVE-2026-109083: Apache Syncope: Remote Code Execution via Flowable JUEL expression

oss-security ()1
Read at seclists.org
Part of a story covered by 5 sourcesApache Syncope vulnerabilities enable RCE, bypasses and escalationMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Administrators can import arbitrary BPMN process definitions containing JUEL expressions via REST API.

Apache Syncope versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8 and 4.1.0 through 4.1.3 contain an improper isolation vulnerability. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a JUEL expression is imported, remote code execution occurs.

Key facts
  • Apache Syncope 3.0.0-M0 through 3.0.16
  • Apache Syncope 4.0.0-M0 through 4.0.8
  • Apache Syncope 4.1.0 through 4.1.3
Security assessment · AI, from the article
What to do
  1. 1.Upgrade to Apache Syncope 3.0.16 or later
  2. 2.Upgrade to Apache Syncope 4.0.8 or later
  3. 3.Upgrade to Apache Syncope 4.1.3 or later
Analyze CVE-2026-109083 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-109083
Tags
syncopercebpmnjuel
Vendors
Apache
Products
Syncope

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-109083
RCE via JUEL in Apache Syncope BPMN import
9.8—

From the original article

Posted by Francesco Chicchiriccò on Nov 02 Severity: moderate Affected versions: - Apache Syncope 3. 0. 0-M0 through 3.

oss-security

seclists.org

Read the full article at oss-security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.