Apache Syncope CVE-2026-109083

Exploitation requires an authenticated Syncope administrator holding entitlements adequate to import and start BPMN process definitions, plus reachable access to the Syncope REST API. The specific prerequisite is the ability to import a BPMN process definition that contains a JUEL expression attribute and then start that process; the expression is then evaluated server-side with no sandbox. Limiting factors: this is a high-privilege, post-authentication capability (not anonymous or low-privilege), so risk concentrates where admin/workflow-management entitlements are widely delegated. Fixed versions 4.0.9 / 4.1.4 close the vector by rejecting BPMN definitions that include expression attributes; the description does not state a fix for the affected 3.0.x branch.

No CVSS vector or score was supplied (CVSS: N/A), so severity signals must be reasoned from the description rather than read off a vector. The flaw is a server-side code-execution issue: an administrator with adequate entitlements can import a BPMN process definition containing a JUEL expression and start it, causing the expression to execute on the server with no sandbox (CWE-653, improper isolation/compartmentalization). This is powerful but gated by high privilege - the actor must already hold administrative entitlements sufficient to import and run workflow definitions, which bounds real-world risk to post-authentication, insider, or compromised-admin scenarios rather than anonymous internet exploitation. No EPSS score was provided, the vulnerability is not listed in CISA KEV, and the single reference is an Apache advisory thread rather than exploit code, so there is no evidence of active exploitation or a public PoC. The vuln.today decision label is 'this_month', consistent with a serious but not emergency priority. Net: a genuinely high-impact (full server code execution) but high-privilege issue; prioritize patching on the normal cycle, with elevated attention where Syncope admin entitlements are broadly delegated. Note one gap in the data: the description lists the 3.0.x branch (3.0.0-M0 through 3.0.16) as affected but only names fixes for the 4.0.x and 4.1.x branches (4.0.9 / 4.1.4) - verify remediation guidance for 3.0.x with the vendor.

An administrator (or an attacker who has obtained administrative entitlements) uses the Syncope REST API to import a crafted BPMN process definition that embeds a JUEL expression, then starts the process. Because the expression is evaluated directly and unsandboxed, the attacker's code runs on the Syncope server. No public exploit code or PoC was identified at time of analysis; exploitation requires the privileged import-and-start capability.