EUVD-2026-45955
GHSA-fxgm-87fw-pcmm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Requires an authenticated admin with Implementation entitlements so PR:H, not PR:N; network-reachable console and simple crafting give AV:N/AC:L, and sandbox escape yields full C/I/A code execution.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Improper Isolation or Compartmentalization vulnerability in Apache Syncope.
An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code bypassing the Groovy security sandbox.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.6, from 4.1.0-M0 through 4.1.1.
Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue by tightening the Groovy security sandbox.
AnalysisAI
Groovy sandbox escape in Apache Syncope's Implementations feature lets an administrator holding Implementation entitlements author a malicious Groovy class that runs untrusted code outside the intended security sandbox, effectively achieving arbitrary code execution on the identity-management server. It affects Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Apache Syncope administrator account that holds the entitlements to create or modify Implementations (the Groovy-scripting feature); this is the exact prerequisite stated in the advisory ('an administrator with adequate entitlements for Implementations'). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals conflict and must be read carefully. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained or been granted a Syncope administrator account with Implementation entitlements - for example a malicious insider or an admin whose session was phished - navigates to the Implementations section and submits a Groovy class crafted to escape the sandbox. When Syncope compiles and runs that Implementation, the untrusted code executes with the server's privileges, allowing the attacker to read stored identity data or run OS-level commands. … |
| Remediation | Vendor-released patch: upgrade to Apache Syncope 4.0.7 (for the 4.0.x line) or 4.1.2 (for the 4.1.x line), which tighten the Groovy security sandbox; the 3.0.x line reaches this fix by migrating to 4.0.7 / 4.1.2 per the Apache advisory (https://lists.apache.org/thread/2236mlm6hbvs6g16yqz5y9s8bb7q1lo1). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Apache Syncope deployments and validate running versions against the affected ranges; immediately review administrator account activity logs and access grants for Implementation entitlements. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Syncope
View allPrivilege escalation in Apache Syncope's identity-management engine lets a self-service user grant themselves defined Ro
SQL injection in Apache Syncope allows an administrator holding sufficient entitlements to execute arbitrary SQL through
Server-Side Request Forgery in Apache Syncope lets a low-privileged authenticated user abuse the Connectors and Resource
Remote code execution in Apache Syncope's connector subsystem allows an administrator holding sufficient entitlements to
Remote code execution in Apache Syncope's workflow engine lets an administrator holding sufficient entitlements run arbi
Malicious JEXL expression injection in Apache Syncope's Derived Schema feature enables privileged information disclosure
Same weakness CWE-653 – Improper Isolation or Compartmentalization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today