EUVD-2026-45956
GHSA-xvr8-rwv3-hv45
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Requires an administrator with workflow entitlements so PR:H (not PR:N); network-reachable REST API with no user interaction and unsandboxed code execution yields C/I/A:H.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
4DescriptionCVE.org
Improper Isolation or Compartmentalization vulnerability in Apache Syncope.
An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a Groovy scriptTask is imported and started, the Groovy script is executed directly on the server, with no sandbox.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1.
Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue by wrapping Flowable's Groovy scriptTasks with security sandbox.
AnalysisAI
Remote code execution in Apache Syncope's workflow engine lets an administrator holding sufficient entitlements run arbitrary Groovy code on the server by importing and starting a malicious BPMN process definition through the REST API. Because Flowable's Groovy scriptTasks execute with no sandbox in affected 3.0.x, 4.0.x, and 4.1.x releases, script code embedded in the process runs directly with the privileges of the Syncope core JVM. No public exploit has been identified at time of analysis and the flaw is not in CISA KEV, but the trivial exploitation path once an entitled admin account is reached makes it a strong candidate for post-compromise abuse and insider misuse.
Technical ContextAI
Apache Syncope is an open-source identity and access management (IAM) platform whose core embeds the Flowable BPMN workflow engine to drive user provisioning and approval processes. BPMN process definitions may contain scriptTasks, and Syncope permits these to be authored in Groovy, a JVM scripting language with full access to the Java runtime. The root cause is CWE-653 (Improper Isolation or Compartmentalization): the Groovy scriptTask executor ran with no sandbox or compartmentalization boundary, so any script supplied inside an imported process definition executes with the full authority of the server process rather than in a constrained interpreter. The vendor fix wraps Flowable's Groovy scriptTasks in a security sandbox. The affected component is the Syncope core (CPE cpe:2.3:a:apache_software_foundation:apache_syncope), specifically the REST API used to import and start workflow definitions.
RemediationAI
Vendor-released patch: upgrade to Apache Syncope 4.0.7 or 4.1.2, which fix the issue by wrapping Flowable's Groovy scriptTasks in a security sandbox (advisory: https://lists.apache.org/thread/vdq0tk6ylffz6trbgbllj9kb1ndzff7k). The 3.0.x line has no fixed version listed in the available data, so 3.0.x users should confirm an upgrade path with the vendor and migrate to a patched 4.0.7+/4.1.2+ release. Until patched, restrict and audit the administrative entitlements that permit importing and starting BPMN workflow definitions by granting workflow-definition management to the minimum set of trusted operators, keep the Syncope core REST API off untrusted networks, and review existing BPMN process definitions for unexpected Groovy scriptTasks. Trade-off: tightening workflow entitlements or removing scripted workflow steps may break legitimate provisioning automation that relies on Groovy scriptTasks.
More in Apache Syncope
View allSQL injection in Apache Syncope allows an administrator holding sufficient entitlements to execute arbitrary SQL through
Privilege escalation in Apache Syncope's identity-management engine lets a self-service user grant themselves defined Ro
Server-Side Request Forgery in Apache Syncope lets a low-privileged authenticated user abuse the Connectors and Resource
Code execution via Groovy sandbox bypass in Apache Syncope 3.0 through 3.0.16, 4.0 through 4.0.5, and 4.1.0 allows a hig
Remote code execution in Apache Syncope's connector subsystem allows an administrator holding sufficient entitlements to
Groovy sandbox escape in Apache Syncope's Implementations feature lets an administrator holding Implementation entitleme
Malicious JEXL expression injection in Apache Syncope's Derived Schema feature enables privileged information disclosure
Same weakness CWE-653 – Improper Isolation or Compartmentalization
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today