CVE-2026-109083 Apache Syncope: Remote Code Execution via Flowable JUEL expression

Improper isolation or compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a JUEL expression is imported and started, the expressi...

CVE-2026-109083

Apache Syncope is vulnerable to Remote Code Execution (RCE) due to improper isolation or compartmentalization. An administrator with sufficient entitlements can use the REST API to import arbitrary BPMN process definitions . If these processes contain JUEL expressions , the expressions execute di...