EUVD-2026-45955
GHSA-fxgm-87fw-pcmm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Requires an authenticated admin with Implementation entitlements so PR:H, not PR:N; network-reachable console and simple crafting give AV:N/AC:L, and sandbox escape yields full C/I/A code execution.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
4DescriptionCVE.org
Improper Isolation or Compartmentalization vulnerability in Apache Syncope.
An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code bypassing the Groovy security sandbox.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.6, from 4.1.0-M0 through 4.1.1.
Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue by tightening the Groovy security sandbox.
AnalysisAI
Groovy sandbox escape in Apache Syncope's Implementations feature lets an administrator holding Implementation entitlements author a malicious Groovy class that runs untrusted code outside the intended security sandbox, effectively achieving arbitrary code execution on the identity-management server. It affects Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the published CVSS of 9.8 overstates real-world exposure because the flaw requires a privileged administrator account.
Technical ContextAI
Apache Syncope is a Java-based open-source identity and access management (IAM) system that lets operators define custom logic through 'Implementations,' which can be supplied as Groovy scripts compiled and executed at runtime. To contain this dynamic code, Syncope relies on a Groovy security sandbox that is meant to whitelist safe operations. The vulnerability is classified CWE-653 (Improper Isolation or Compartmentalization): the sandbox boundary is incomplete, so a crafted Groovy class can reach APIs and system calls it should be denied. The single affected component is cpe:2.3:a:apache_software_foundation:apache_syncope, and the fix in 4.0.7 / 4.1.2 works by tightening the Groovy security sandbox rather than removing the scripting capability.
RemediationAI
Vendor-released patch: upgrade to Apache Syncope 4.0.7 (for the 4.0.x line) or 4.1.2 (for the 4.1.x line), which tighten the Groovy security sandbox; the 3.0.x line reaches this fix by migrating to 4.0.7 / 4.1.2 per the Apache advisory (https://lists.apache.org/thread/2236mlm6hbvs6g16yqz5y9s8bb7q1lo1). Until patched, the most effective compensating control is to restrict who holds Implementation-related entitlements: audit and remove the Implementation create/update privileges from all but a minimal set of fully trusted administrators, since exploitation depends on that entitlement - the trade-off is that legitimate operators can no longer author custom Groovy logic. Additionally, monitor and log all Implementation create/modify events and treat any new Groovy Implementation as a change-control-gated action, and place the Syncope admin console behind network segmentation and strong (MFA) administrator authentication to reduce the chance of an attacker obtaining the required admin session in the first place.
More in Apache Syncope
View allSQL injection in Apache Syncope allows an administrator holding sufficient entitlements to execute arbitrary SQL through
Privilege escalation in Apache Syncope's identity-management engine lets a self-service user grant themselves defined Ro
SQL injection in Apache Syncope's Task search endpoint allows an authenticated administrator to execute arbitrary SQL th
Server-Side Request Forgery in Apache Syncope lets a low-privileged authenticated user abuse the Connectors and Resource
Incorrect authorization in Apache Syncope's delegated administration module allows an authenticated delegated administra
OIDC client secret exposure in Apache Syncope enables any authenticated user to retrieve complete OIDC provider configur
Sensitive AES key material is written in plaintext to Apache Syncope application logs under a specific misconfiguration
CSV formula injection in Apache Syncope allows authenticated low-privilege users to embed spreadsheet formula payloads i
Code execution via Groovy sandbox bypass in Apache Syncope 3.0 through 3.0.16, 4.0 through 4.0.5, and 4.1.0 allows a hig
Remote code execution in Apache Syncope's connector subsystem allows an administrator holding sufficient entitlements to
Remote code execution in Apache Syncope's workflow engine lets an administrator holding sufficient entitlements run arbi
Broken delegated-administration authorization in Apache Syncope's Reconciliation service lets an authenticated administr
Same weakness CWE-653 – Improper Isolation or Compartmentalization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today