Apache Syncope
Monthly
Server-Side Request Forgery in Apache Syncope lets a low-privileged authenticated user abuse the Connectors and Resources connectivity check to coerce the server into issuing arbitrary outbound requests. Affected builds span the 3.0.x, 4.0.x, and 4.1.x lines up to 3.0.16, 4.0.6, and 4.1.1 respectively, with high confidentiality and integrity impact per the CVSS 8.1 rating. There is no public exploit identified at time of analysis, and CISA SSVC scores exploitation as 'none,' but the total technical impact and low privilege bar make this a meaningful internal-network exposure.
Privilege escalation in Apache Syncope's identity-management engine lets a self-service user grant themselves defined Roles via a single REST API call, effectively promoting a low-privileged or newly self-registered account to administrator. It affects deployments running the all-Java user workflow adapter, or the Flowable adapter with a BPMN definition that does not require admin approval for self-registration or self-update, across versions 3.0.0-M0-3.0.16, 4.0.0-M0-4.0.6, and 4.1.0-M0-4.1.1. The Apache-issued advisory rates it CVSS 9.8; no public exploit identified at time of analysis and it is not on CISA KEV.
SQL injection in Apache Syncope allows an administrator holding sufficient entitlements to execute arbitrary SQL through stacked queries by abusing unsanitized sort parameters, affecting the 3.0.x, 4.0.x, and 4.1.x branches up to 3.0.16, 4.0.6, and 4.1.1 respectively. Because stacked queries are supported, an attacker can go beyond data theft to modify or destroy identity data and potentially chain to further backend compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; note the NVD CVSS 9.8 (PR:N) contradicts the vendor description, which explicitly requires an authenticated privileged administrator.
Remote code execution in Apache Syncope's connector subsystem allows an administrator holding sufficient entitlements to run arbitrary Groovy scripts through scripted REST and SQL connectors, escaping the intended sandbox and executing code on the host. It affects Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1, and is rooted in improper isolation (CWE-653) of the scripting engine. Although the published CVSS is 9.8, the vendor description states an authenticated privileged administrator is required, and there is no public exploit identified at time of analysis.
Remote code execution in Apache Syncope's workflow engine lets an administrator holding sufficient entitlements run arbitrary Groovy code on the server by importing and starting a malicious BPMN process definition through the REST API. Because Flowable's Groovy scriptTasks execute with no sandbox in affected 3.0.x, 4.0.x, and 4.1.x releases, script code embedded in the process runs directly with the privileges of the Syncope core JVM. No public exploit has been identified at time of analysis and the flaw is not in CISA KEV, but the trivial exploitation path once an entitled admin account is reached makes it a strong candidate for post-compromise abuse and insider misuse.
Groovy sandbox escape in Apache Syncope's Implementations feature lets an administrator holding Implementation entitlements author a malicious Groovy class that runs untrusted code outside the intended security sandbox, effectively achieving arbitrary code execution on the identity-management server. It affects Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the published CVSS of 9.8 overstates real-world exposure because the flaw requires a privileged administrator account.
Code execution via Groovy sandbox bypass in Apache Syncope 3.0 through 3.0.16, 4.0 through 4.0.5, and 4.1.0 allows a high-privileged administrator holding Implementations entitlements to run untrusted code outside the sandbox. By placing payload logic in a Groovy class static initializer, the attacker reaches a non-sandboxed execution path, yielding full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and EPSS is very low (0.02%, 6th percentile), consistent with a privilege-gated, not mass-scanned, issue.
Malicious JEXL expression injection in Apache Syncope's Derived Schema feature enables privileged information disclosure across administrative roles. An administrator holding entitlements over Derived Schemas can embed a crafted JEXL expression that, when evaluated in the context of another administrator's User read operation, exposes security-sensitive User attributes that would not normally be accessible. Affected versions span three release lines (3.0.x through 3.0.16, 4.0.x through 4.0.5, and 4.1.0); no active exploitation is confirmed (no CISA KEV listing) and the EPSS score of 0.02% places this in the 4th percentile for exploitation probability.
Server-Side Request Forgery in Apache Syncope lets a low-privileged authenticated user abuse the Connectors and Resources connectivity check to coerce the server into issuing arbitrary outbound requests. Affected builds span the 3.0.x, 4.0.x, and 4.1.x lines up to 3.0.16, 4.0.6, and 4.1.1 respectively, with high confidentiality and integrity impact per the CVSS 8.1 rating. There is no public exploit identified at time of analysis, and CISA SSVC scores exploitation as 'none,' but the total technical impact and low privilege bar make this a meaningful internal-network exposure.
Privilege escalation in Apache Syncope's identity-management engine lets a self-service user grant themselves defined Roles via a single REST API call, effectively promoting a low-privileged or newly self-registered account to administrator. It affects deployments running the all-Java user workflow adapter, or the Flowable adapter with a BPMN definition that does not require admin approval for self-registration or self-update, across versions 3.0.0-M0-3.0.16, 4.0.0-M0-4.0.6, and 4.1.0-M0-4.1.1. The Apache-issued advisory rates it CVSS 9.8; no public exploit identified at time of analysis and it is not on CISA KEV.
SQL injection in Apache Syncope allows an administrator holding sufficient entitlements to execute arbitrary SQL through stacked queries by abusing unsanitized sort parameters, affecting the 3.0.x, 4.0.x, and 4.1.x branches up to 3.0.16, 4.0.6, and 4.1.1 respectively. Because stacked queries are supported, an attacker can go beyond data theft to modify or destroy identity data and potentially chain to further backend compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; note the NVD CVSS 9.8 (PR:N) contradicts the vendor description, which explicitly requires an authenticated privileged administrator.
Remote code execution in Apache Syncope's connector subsystem allows an administrator holding sufficient entitlements to run arbitrary Groovy scripts through scripted REST and SQL connectors, escaping the intended sandbox and executing code on the host. It affects Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1, and is rooted in improper isolation (CWE-653) of the scripting engine. Although the published CVSS is 9.8, the vendor description states an authenticated privileged administrator is required, and there is no public exploit identified at time of analysis.
Remote code execution in Apache Syncope's workflow engine lets an administrator holding sufficient entitlements run arbitrary Groovy code on the server by importing and starting a malicious BPMN process definition through the REST API. Because Flowable's Groovy scriptTasks execute with no sandbox in affected 3.0.x, 4.0.x, and 4.1.x releases, script code embedded in the process runs directly with the privileges of the Syncope core JVM. No public exploit has been identified at time of analysis and the flaw is not in CISA KEV, but the trivial exploitation path once an entitled admin account is reached makes it a strong candidate for post-compromise abuse and insider misuse.
Groovy sandbox escape in Apache Syncope's Implementations feature lets an administrator holding Implementation entitlements author a malicious Groovy class that runs untrusted code outside the intended security sandbox, effectively achieving arbitrary code execution on the identity-management server. It affects Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the published CVSS of 9.8 overstates real-world exposure because the flaw requires a privileged administrator account.
Code execution via Groovy sandbox bypass in Apache Syncope 3.0 through 3.0.16, 4.0 through 4.0.5, and 4.1.0 allows a high-privileged administrator holding Implementations entitlements to run untrusted code outside the sandbox. By placing payload logic in a Groovy class static initializer, the attacker reaches a non-sandboxed execution path, yielding full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and EPSS is very low (0.02%, 6th percentile), consistent with a privilege-gated, not mass-scanned, issue.
Malicious JEXL expression injection in Apache Syncope's Derived Schema feature enables privileged information disclosure across administrative roles. An administrator holding entitlements over Derived Schemas can embed a crafted JEXL expression that, when evaluated in the context of another administrator's User read operation, exposes security-sensitive User attributes that would not normally be accessible. Affected versions span three release lines (3.0.x through 3.0.16, 4.0.x through 4.0.5, and 4.1.0); no active exploitation is confirmed (no CISA KEV listing) and the EPSS score of 0.02% places this in the 4th percentile for exploitation probability.