77 matches found
Arbitrary Code Execution
Apache Syncope is vulnerable to an Arbitrary Code Execution. The vulnerability is due to imported BPMN processes allowing unsandboxed Groovy scriptTask execution, which allows an attacker with sufficient administrative entitlements to import and start a malicious BPMN process through the REST API...
EUVD-2026-78206
Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml that fails to disable external entity resolution when parsing deployed BPMN resources. Attackers with process deployment privileges can embed DOCTYPE declarations...
CVE-2026-91197
Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml that fails to disable external entity resolution when parsing deployed BPMN resources. Attackers with process deployment privileges can embed DOCTYPE declarations...
CVE-2026-91197 Flowable flowable-engine through 8.0.0 XXE via ProcessDiagramLayoutFactory
Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml that fails to disable external entity resolution when parsing deployed BPMN resources. Attackers with process deployment privileges can embed DOCTYPE declarations...
CVE-2026-91197 Flowable flowable-engine through 8.0.0 XXE via ProcessDiagramLayoutFactory
Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml that fails to disable external entity resolution when parsing deployed BPMN resources. Attackers with process deployment privileges can embed DOCTYPE declarations...
CVE-2026-91197
Flowable flowable-engine through 8.0.0 contains an XML External Entity (XXE) injection in ProcessDiagramLayoutFactory.parseXml() , which fails to disable external entity resolution when parsing deployed BPMN resources. Attackers with process deployment privileges can embed DOCTYPE declarations wi...
PT-2026-91755
Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml that fails to disable external entity resolution when parsing deployed BPMN resources. Attackers with process deployment privileges can embed DOCTYPE declarations...
Improper Isolation or Compartmentalization
Overview org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn is an Open Source system for managing digital identities in enterprise environments, Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization via the processEngineConfiguration setup in...
org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=3.0.0-m0, <=4.0.6), org.apache.syncope.ext.flowable:syncope-ext-flowable-rest-cxf (>=3.0.0-m0, <=4.0.6) potentially affected by CVE-2026-53405 via org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn (>=3.0.0-m0, <=4.0.6)
org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn MAVEN version =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.6 Source cves: CVE-2026-53405 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPEEXTFLOWABLE-19352472...
org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=4.1.0-m0, <=4.1.1), org.apache.syncope.ext.flowable:syncope-ext-flowable-rest-cxf (>=4.1.0-m0, <=4.1.1) potentially affected by CVE-2026-53405 via org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn (>=4.1.0-m0, <=4.1.1)
org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.1 Source cves: CVE-2026-53405 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPEEXTFLOWABLE-19352472...
Improper Isolation or Compartmentalization
Overview org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn is an Open Source system for managing digital identities in enterprise environments, Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization through...
org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=3.0.0-m0, <=4.0.6), org.apache.syncope.ext.flowable:syncope-ext-flowable-rest-cxf (>=3.0.0-m0, <=4.0.6) potentially affected by CVE-2026-53421 via org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn (>=3.0.0-m0, <=4.0.6)
org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn MAVEN version =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.6 Source cves: CVE-2026-53421 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPEEXTFLOWABLE-19352511...
org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=4.1.0-m0, <=4.1.1), org.apache.syncope.ext.flowable:syncope-ext-flowable-rest-cxf (>=4.1.0-m0, <=4.1.1) potentially affected by CVE-2026-53421 via org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn (>=4.1.0-m0, <=4.1.1)
org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.1 Source cves: CVE-2026-53421 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPEEXTFLOWABLE-19352511...
CVE-2026-53405
Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a Groovy scriptTask is imported and started, the Groovy...
org.apache.syncope.core:syncope-core-metrics-starter (>=4.1.0-m0, <=4.1.1), org.apache.syncope.core:syncope-core-self-keymaster-starter (>=4.1.0-m0, <=4.1.1) +4 more potentially affected by CVE-2026-62183 via org.apache.syncope.core:syncope-core-workflow-java (>=4.1.0-m0, <=4.1.1)
org.apache.syncope.core:syncope-core-workflow-java MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.1 Source cves: CVE-2026-62183 Source advisory: MEND:CVE-2026-62183...
org.apache.syncope.core:syncope-core-metrics-starter (>=4.0.2, <=4.0.6), org.apache.syncope.core:syncope-core-self-keymaster-starter (>=4.0.0-m0, <=4.0.6) +4 more potentially affected by CVE-2026-62183 via org.apache.syncope.core:syncope-core-workflow-java (>=4.0.0-m0, <=4.0.6)
org.apache.syncope.core:syncope-core-workflow-java MAVEN version =4.0.0-m0, =4.0.2, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.6 Source cves: CVE-2026-62183 Source advisory: MEND:CVE-2026-62183...
CVE-2026-62183 Apache Syncope: User self-service privilege escalation
Improper Privilege Management vulnerability in Apache Syncope. When: the all-Java user workflow adapter is configured, or the Flowable user workflow adapter is configured, bearing a BPMN definition not requiring admin approval for user self registration of self update requests the following...
CVE-2026-62183 Apache Syncope: User self-service privilege escalation
Improper Privilege Management vulnerability in Apache Syncope. When: the all-Java user workflow adapter is configured, or the Flowable user workflow adapter is configured, bearing a BPMN definition not requiring admin approval for user self registration of self update requests the following...
CVE-2026-53405 Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask
Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a Groovy scriptTask is imported and started, the Groovy...
CVE-2026-53405 Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask
Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a Groovy scriptTask is imported and started, the Groovy...