EUVD-2026-45958
GHSA-c7pj-2f8j-jc8m
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor requires an administrator with connector entitlements, so PR:H not PR:N; network-reachable admin API with no added complexity gives AV:N/AC:L, and Groovy RCE yields full C:H/I:H/A:H.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Improper Isolation or Compartmentalization vulnerability in Apache Syncope.
An administrator with adequate entitlements can achieve remote code execution through the connector subsystem by relying on scripted connectors' (REST and SQL) capability to run Groovy scripts.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1.
Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue by hardening the Groovy security sandbox.
AnalysisAI
Remote code execution in Apache Syncope's connector subsystem allows an administrator holding sufficient entitlements to run arbitrary Groovy scripts through scripted REST and SQL connectors, escaping the intended sandbox and executing code on the host. It affects Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1, and is rooted in improper isolation (CWE-653) of the scripting engine. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated administrator possessing entitlements to create or modify connectors, plus the use of a scripted connector type (REST or SQL) whose Groovy-scripting capability is invoked - this scripting capability IS the required feature. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, score 9.8) conflicts with the vendor's own description, which explicitly states the actor must be 'an administrator with adequate entitlements' - that implies privileges are required (PR:H/PR:L), not PR:N. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An administrator (or an attacker who has compromised admin credentials) with connector-management entitlements creates or edits a scripted REST or SQL connector and embeds a malicious Groovy payload that escapes the sandbox. When the connector executes, the payload runs arbitrary code on the Syncope host with the privileges of the application's JVM. … |
| Remediation | Vendor-released patch: upgrade to Apache Syncope 4.0.7 or 4.1.2, which fix the issue by hardening the Groovy security sandbox; 3.0.x users should move to a fixed 4.0.x/4.1.x release since no fixed 3.0.x version is cited in the advisory (confirm the 3.0 upgrade path with Apache). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all systems running Apache Syncope, document affected versions (3.0.0-3.0.16, 4.0.0-4.0.6, 4.1.0-4.1.1), and assess administrative user access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Syncope
View allPrivilege escalation in Apache Syncope's identity-management engine lets a self-service user grant themselves defined Ro
SQL injection in Apache Syncope allows an administrator holding sufficient entitlements to execute arbitrary SQL through
Server-Side Request Forgery in Apache Syncope lets a low-privileged authenticated user abuse the Connectors and Resource
Remote code execution in Apache Syncope's workflow engine lets an administrator holding sufficient entitlements run arbi
Groovy sandbox escape in Apache Syncope's Implementations feature lets an administrator holding Implementation entitleme
Malicious JEXL expression injection in Apache Syncope's Derived Schema feature enables privileged information disclosure
Same weakness CWE-653 – Improper Isolation or Compartmentalization
View allShare
External POC / Exploit Code
Leaving vuln.today