Apache Syncope vulnerabilities enable RCE, bypasses and escalation

Multiple CVEs in Apache Syncope allow remote code execution, authorization bypass, privilege escalation and SQL injection in versions 3.0.0-M0 to 4.1.3.

Several vulnerabilities have been reported in Apache Syncope. An administrator can trigger remote code execution by importing BPMN process definitions with JUEL expressions via the REST API. Delegated administrators can bypass Realm update boundaries without destination permissions. Non-admin users can escalate privileges by configuring impersonation in self-updates. An administrator can achieve remote code execution by creating malicious Groovy classes that run on a separate thread. The SQL injection in audit events search was introduced by an incomplete fix for a prior vulnerability.