CVE-2026-63071

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through...

CVE-2026-42797

Apache Syncope versions 3.0 through 3.0.16 , 4.0 through 4.0.5 , and 4.1.0 are vulnerable to an Exposure of Sensitive Information Through Data Queries vulnerability. The root cause is that an administrator with entitlements for Derived Schemas can create a malicious JEXL expression . This allows ...