Remote code execution via unsandboxed Groovy scriptTask in Apache Syncope (CVE-2026-53405)

Apache Syncope contains an improper isolation vulnerability in its Flowable BPMN extension that allows an administrator with adequate entitlements to import arbitrary BPMN process definitions via the REST API. When a BPMN process containing a Groovy scriptTask is imported and started, the Groovy script executes directly on the server without a sandbox, enabling remote code execution. Affected versions: - Apache Syncope (org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn) 3.0.0-M0 through 3.0.16 - Apache Syncope (org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn) 4.0.0-M0 through 4.0.6 - Apache Syncope (org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn) 4.1.0-M0 through 4.1.1 We recommend updating to: 4.0.7, 4.1.2. CVSS 9.8 · our assessment: act_now Reference: https://lists.apache.org/thread/vdq0tk6ylffz6trbgbllj9kb1ndzff7k Details: https://vuln.today/cve/CVE-2026-53405