Improper Isolation Vulnerability in Apache Syncope

CVE-2026-42782

What is CVE-2026-42782?

An improper isolation vulnerability exists in Apache Syncope, allowing an authorized administrator to create a malicious Groovy class. This class can execute untrusted code through non-sandboxed execution paths via the static initializer. Affected versions include 3.0 through 3.0.16, 4.0 through 4.0.5, and 4.1.0. Users are advised to upgrade to versions 4.0.6 or 4.1.1, which enhance security by enforcing sandboxing for Groovy static initializers.

References