Description
Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve remote code execution through the connector subsystem by relying on scripted connectors' (REST and SQL) capability to run Groovy scripts. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue by hardening the Groovy security sandbox.
Affected products
apache: syncope
References2
- lists.apache.org/thread/nmzvz6gb2ldm30wvyk613r8dfrb6r8yx Mailing ListVendor Advisory
- www.openwall.com/lists/oss-security/2026/07/20/7 Mailing ListThird Party Advisory
Metrics
- CVSS 3.1
-
9.8
CRITICAL
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 1% percentile: 67 · as of 14 November 2026
- CWE
- CWE-653
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.