Improper Isolation Vulnerability in Apache Syncope
CVE-2026-113687

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Syncope
Vendor
CVE Published:
2 November 2026

What is CVE-2026-113687?

An improper isolation vulnerability exists in Apache Syncope that allows an administrator with adequate entitlements to create a malicious Groovy class. This class can run untrusted code on a separate thread, effectively bypassing the Groovy security sandbox. It affects multiple versions of Apache Syncope, from 3.0.0-M0 to 4.1.3. Users are advised to upgrade to versions 4.0.9 or 4.1.4 to remediate this issue.

Affected Version(s)

Apache Syncope 3.0.0-M0 <= 3.0.16

Apache Syncope 4.0.0-M0 <= 4.0.8

Apache Syncope 4.1.0-M0 <= 4.1.3

References

https://lists.apache.org/thread.html/xxfmworgxt6bf1got05b...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alex Palinkash
.