Improper Isolation Vulnerability in Apache Syncope Affects Multiple Versions

CVE-2026-109083

What is CVE-2026-109083?

An improper isolation vulnerability exists in Apache Syncope that allows an administrator with sufficient privileges to import and execute arbitrary BPMN process definitions through the REST API. When a BPMN process that includes a JUEL expression is imported and triggered, the server executes the expression without any security sandboxing. This poses a significant risk as malicious actors could leverage this flaw to execute harmful code directly on the server. Users should update to version 4.0.9 or 4.1.4, which provide fixes to reject BPMN definitions with expression attributes, thereby enhancing security.

References