EUVD-2026-77457
GHSA-fp6q-c836-37rh
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Network-reachable admin console, low attack complexity, but requires high-privileged Implementations entitlements, so PR:H; no availability impact.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
4DescriptionCVE.org
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Syncope.
An administrator with adequate entitlements for Implementations can create a malicious Groovy Command class containing untrusted code in their CommandArgs static implementation, bypassing the Groovy security sandbox.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2.
Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
AnalysisAI
Apache Syncope contains a Groovy sandbox bypass (CWE-94 code injection) that lets an administrator holding entitlements over the Implementations console register a malicious Groovy Command class whose untrusted code executes in a static CommandArgs initializer, escaping the intended script sandbox. Affected releases span 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2; exploitation requires a privileged, already-authenticated administrator account (CVSS 3.1 vector PR:H, score 6.5) rather than an anonymous attacker. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated administrator account that holds the specific entitlements needed to create or modify Implementation objects in Apache Syncope (the 'Implementations' console area) - this is exactly the PR:H condition in the CVSS vector, and it is a delegated administrative role rather than a standard user account. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) describes a network-reachable, low-complexity attack that nonetheless demands high privileges - an authenticated Syncope administrator with Implementations entitlements - and no user interaction; scope is unchanged but confidentiality and integrity are fully impacted while availability is not. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Apache Syncope 4.0.8 or 4.1.3 - the vendor-released patch versions that fix this issue (advisory: https://lists.apache.org/thread/qr464o2lyj3rxp8b0q25ssn0qwjxyrgz; oss-security: https://seclists.org/oss-sec/2026/q3/765). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today