Apache Syncope CVE-2026-113687

Exploitation requires an authenticated Apache Syncope administrator account that has been granted entitlements for the Implementations feature; the attacker uses that feature to define a malicious Groovy class whose untrusted code runs on a separate thread, which is the specific mechanism that defeats the Groovy security sandbox. The primary limiting factors are the high privilege level (an admin with the Implementations entitlement, not an ordinary or unauthenticated user) and that the attack operates through a legitimate administrative capability; authentication requirements are described by the vendor but cannot be tied to a CVSS PR metric because no CVSS vector was provided. Affected only in versions 3.0.0-M0-3.0.16, 4.0.0-M0-4.0.8, and 4.1.0-M0-4.1.3; the vendor states upgrading to 4.0.9 / 4.1.4 fixes the issue.

This is a privilege-dependent sandbox-escape issue, not a remotely-triggerable flaw against unauthenticated users. No CVSS score or vector is supplied by NVD or the vendor, so attack-vector/complexity/privilege cannot be read from an authoritative vector; based on the description, exploitation requires an existing administrator who holds entitlements for the Implementations feature, which is a high-privilege precondition. EPSS is not provided, the CVE is not listed in CISA KEV, and no public exploit or PoC reference is present - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vuln.today decision label is 'this_week', indicating elevated but non-emergency priority. The real-world risk is therefore gated almost entirely on the trust model for Syncope administrators: an attacker must already be a privileged operator, and the vulnerability lets that operator break out of the Groovy security sandbox to run arbitrary untrusted code on a separate thread. For organizations that treat the Implementations entitlement as a strong trust boundary (expecting the sandbox to contain what admins can run), this is a genuine privilege/isolation failure worth prompt patching; for organizations where such admins are already fully trusted, the marginal risk is lower. Key missing data: no CVSS vector, no EPSS, no confirmed PoC - all of which should be weighed before escalating beyond the vendor's own 'upgrade' guidance.

An authenticated Syncope administrator who has been granted entitlements for Implementations defines a malicious Groovy class that launches untrusted code on a separate thread, which escapes the Groovy security sandbox and executes arbitrary code within the Syncope server process. No public exploit or PoC reference is provided, and there is no evidence of active exploitation. The practical limiting factor is that the attacker must already possess a high-privilege administrative role with the specific Implementations entitlement.