Improper Isolation Vulnerability in Apache Syncope
CVE-2026-42782

7.2HIGH

Key Information:

Vendor

Apache
Status
Apache Syncope
Vendor
CVE Published:
25 May 2026

What is CVE-2026-42782?

An improper isolation vulnerability exists in Apache Syncope, allowing an authorized administrator to create a malicious Groovy class. This class can execute untrusted code through non-sandboxed execution paths via the static initializer. Affected versions include 3.0 through 3.0.16, 4.0 through 4.0.5, and 4.1.0. Users are advised to upgrade to versions 4.0.6 or 4.1.1, which enhance security by enforcing sandboxing for Groovy static initializers.

Affected Version(s)

Apache Syncope 3.0 <= 3.0.16

Apache Syncope 4.0 <= 4.0.5

Apache Syncope 4.1 <= 4.1.0

References

https://lists.apache.org/thread/b869ms0ofrd129f7tgsn9flxg...
vendor-advisory

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Trung Nguyen, CyStack
.