Improper Isolation Vulnerability in Apache Syncope

CVE-2026-53421

What is CVE-2026-53421?

An improper isolation vulnerability exists in Apache Syncope, allowing administrators with sufficient entitlements to execute remote code via scripted connectors. This risk is particularly associated with the ability of REST and SQL connectors to run Groovy scripts. Versions 3.0.0-M0 through 3.0.16 and 4.0.0-M0 through 4.0.6 are affected, highlighting the need for immediate upgrades to versions 4.0.7 and 4.1.2, which enhance Groovy security sandboxing.

References