EUVD-2026-45958
GHSA-c7pj-2f8j-jc8m
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor requires an administrator with connector entitlements, so PR:H not PR:N; network-reachable admin API with no added complexity gives AV:N/AC:L, and Groovy RCE yields full C:H/I:H/A:H.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
4DescriptionCVE.org
Improper Isolation or Compartmentalization vulnerability in Apache Syncope.
An administrator with adequate entitlements can achieve remote code execution through the connector subsystem by relying on scripted connectors' (REST and SQL) capability to run Groovy scripts.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1.
Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue by hardening the Groovy security sandbox.
AnalysisAI
Remote code execution in Apache Syncope's connector subsystem allows an administrator holding sufficient entitlements to run arbitrary Groovy scripts through scripted REST and SQL connectors, escaping the intended sandbox and executing code on the host. It affects Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1, and is rooted in improper isolation (CWE-653) of the scripting engine. Although the published CVSS is 9.8, the vendor description states an authenticated privileged administrator is required, and there is no public exploit identified at time of analysis.
Technical ContextAI
Apache Syncope is an open-source identity management (IdM/IGA) platform used to provision and synchronize identities across external systems via ConnId-based connectors. Scripted connectors (REST and SQL variants) intentionally support Groovy scripts to transform or route provisioning data, executing them inside a security sandbox. The flaw is CWE-653 (Improper Isolation or Compartmentalization): the Groovy sandbox does not sufficiently confine script execution, so a user permitted to define connector scripts can break out of the intended boundary and reach the underlying JVM/host. The single affected product per CPE is cpe:2.3:a:apache_software_foundation:apache_syncope, and the root cause is insufficient hardening of the Groovy engine rather than a memory-safety or injection defect in a parser.
RemediationAI
Vendor-released patch: upgrade to Apache Syncope 4.0.7 or 4.1.2, which fix the issue by hardening the Groovy security sandbox; 3.0.x users should move to a fixed 4.0.x/4.1.x release since no fixed 3.0.x version is cited in the advisory (confirm the 3.0 upgrade path with Apache). Until patching, reduce the entitlement footprint by removing connector-management and script-editing entitlements from all but a minimal set of trusted administrators, avoid or disable scripted REST and SQL connectors that execute Groovy where they are not operationally required, and restrict network access to the Syncope admin console/core so only trusted management hosts can reach it - noting the trade-off that curtailing scripted connectors may break provisioning workflows that legitimately depend on Groovy transformations. Follow the official advisory at https://lists.apache.org/thread/nmzvz6gb2ldm30wvyk613r8dfrb6r8yx for exact upgrade guidance.
More in Apache Syncope
View allSQL injection in Apache Syncope allows an administrator holding sufficient entitlements to execute arbitrary SQL through
Privilege escalation in Apache Syncope's identity-management engine lets a self-service user grant themselves defined Ro
SQL injection in Apache Syncope's Task search endpoint allows an authenticated administrator to execute arbitrary SQL th
Server-Side Request Forgery in Apache Syncope lets a low-privileged authenticated user abuse the Connectors and Resource
Incorrect authorization in Apache Syncope's delegated administration module allows an authenticated delegated administra
OIDC client secret exposure in Apache Syncope enables any authenticated user to retrieve complete OIDC provider configur
Sensitive AES key material is written in plaintext to Apache Syncope application logs under a specific misconfiguration
CSV formula injection in Apache Syncope allows authenticated low-privilege users to embed spreadsheet formula payloads i
Code execution via Groovy sandbox bypass in Apache Syncope 3.0 through 3.0.16, 4.0 through 4.0.5, and 4.1.0 allows a hig
Remote code execution in Apache Syncope's workflow engine lets an administrator holding sufficient entitlements run arbi
Groovy sandbox escape in Apache Syncope's Implementations feature lets an administrator holding Implementation entitleme
Broken delegated-administration authorization in Apache Syncope's Reconciliation service lets an authenticated administr
Same weakness CWE-653 – Improper Isolation or Compartmentalization
View allShare
External POC / Exploit Code
Leaving vuln.today