Improper Isolation Vulnerability in Apache Syncope by Apache

CVE-2026-53405

What is CVE-2026-53405?

An improper isolation vulnerability in Apache Syncope allows administrators with the right entitlements to import and start arbitrary BPMN process definitions through the REST API. This vulnerability can enable an unauthorized execution of Groovy scripts on the server, as there is no security sandboxing in place. The issue affects multiple versions, and it is imperative for users to upgrade to versions 4.0.7 or 4.1.2 to mitigate the risk by implementing security measures that restrict Groovy script execution.

References