Improper Isolation or Compartmentalization

Overview org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn is an Open Source system for managing digital identities in enterprise environments, Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization through...

org.apache.syncope.core.idm:syncope-core-idm-rest-cxf (>=4.1.0-m0, <=4.1.1), org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=4.1.0-m0, <=4.1.1) +3 more potentially affected by CVE-2026-62418 via org.apache.syncope.core.idm:syncope-core-idm-logic (>=4.1.0-m0, <=4.1.1)

org.apache.syncope.core.idm:syncope-core-idm-logic MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.1 Source cves: CVE-2026-62418 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPECOREIDM-19352416...

org.apache.syncope.core.idm:syncope-core-idm-rest-cxf (>=4.1.0-m0, <=4.1.1), org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=4.1.0-m0, <=4.1.1) +3 more potentially affected by CVE-2026-62418 via org.apache.syncope.core.idm:syncope-core-idm-logic (>=4.1.0-m0, <=4.1.1)

org.apache.syncope.core.idm:syncope-core-idm-logic MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.1 Source cves: CVE-2026-62418 Source advisory: MEND:CVE-2026-62418...

org.apache.syncope.core:syncope-core-metrics-starter (>=4.1.0-m0, <=4.1.1), org.apache.syncope.core:syncope-core-self-keymaster-starter (>=4.1.0-m0, <=4.1.1) +4 more potentially affected by CVE-2026-62183 via org.apache.syncope.core:syncope-core-workflow-java (>=4.1.0-m0, <=4.1.1)

org.apache.syncope.core:syncope-core-workflow-java MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.1 Source cves: CVE-2026-62183 Source advisory: MEND:CVE-2026-62183...

org.apache.syncope.core:syncope-core-metrics-starter (>=4.0.2, <=4.0.6), org.apache.syncope.core:syncope-core-self-keymaster-starter (>=4.0.0-m0, <=4.0.6) +4 more potentially affected by CVE-2026-62183 via org.apache.syncope.core:syncope-core-workflow-java (>=4.0.0-m0, <=4.0.6)

org.apache.syncope.core:syncope-core-workflow-java MAVEN version =4.0.0-m0, =4.0.2, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.6 Source cves: CVE-2026-62183 Source advisory: MEND:CVE-2026-62183...

CVE-2026-62183 Apache Syncope: User self-service privilege escalation

Improper Privilege Management vulnerability in Apache Syncope. When: the all-Java user workflow adapter is configured, or the Flowable user workflow adapter is configured, bearing a BPMN definition not requiring admin approval for user self registration of self update requests the following...

org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=4.1.0-m0, <=4.1.1), org.apache.syncope.ext.flowable:syncope-ext-flowable-rest-cxf (>=4.1.0-m0, <=4.1.1) potentially affected by CVE-2026-53405 via org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn (>=4.1.0-m0, <=4.1.1)

org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.1 Source cves: CVE-2026-53405 Source advisory: MEND:CVE-2026-53405...

CVE-2026-53405

The Apache Syncope identity management system (specifically the org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn package) is vulnerable to an Improper Isolation or Compartmentalization issue. An administrator with adequate entitlements can use the REST API to import and start arbitrary B...

CVE-2026-53405 Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a Groovy scriptTask is imported and started, the Groovy...

CVE-2026-53405 Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a Groovy scriptTask is imported and started, the Groovy...

CVE-2026-53405 Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a Groovy scriptTask is imported and started, the Groovy...

EUVD-2026-45956

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a Groovy scriptTask is imported and started, the Groovy...

org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=4.0.0-m0, <=4.0.6), org.apache.syncope.ext.flowable:syncope-ext-flowable-rest-cxf (>=4.0.0-m0, <=4.0.6) potentially affected by CVE-2026-53405 via org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn (>=4.0.0-m0, <=4.0.6)

org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn MAVEN version =4.0.0-m0, =4.0.0-m0, =4.0.0-m0, =4.0.6 Source cves: CVE-2026-53405 Source advisory: MEND:CVE-2026-53405...

com.ahome-it:ahome-tooling-server-core (>=1.0.94-release, <=1.0.109-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.0.100-release, <=1.0.109-release) +12 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (4.1.6.release)

org.springframework.integration:spring-integration-file MAVEN version 4.1.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: - com.ahome-it:ahome-tooling-server-core...

org.apache.syncope.client.am:syncope-client-am-console (>=4.0.0, <=4.0.3), org.apache.syncope.client.idm:syncope-client-idm-console (>=4.0.0, <=4.0.3) +4 more potentially affected by CVE-2026-23795 via org.apache.syncope.client.idrepo:syncope-client-idrepo-console (>=4.0.0, <=4.0.3)

org.apache.syncope.client.idrepo:syncope-client-idrepo-console MAVEN version =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.3 Source cves: CVE-2026-23795 Source advisory: OSV:GHSA-73F3-RQQF-2J54...

org.apache.syncope.client.am:syncope-client-am-console (>=3.0.0, <=3.0.15), org.apache.syncope.client.idm:syncope-client-idm-console (>=3.0.0, <=3.0.15) +4 more potentially affected by CVE-2026-23795 via org.apache.syncope.client.idrepo:syncope-client-idrepo-console (>=3.0.0, <=3.0.15)

org.apache.syncope.client.idrepo:syncope-client-idrepo-console MAVEN version =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.15 Source cves: CVE-2026-23795 Source advisory: GHSA-73F3-RQQF-2J54...

org.apache.syncope.client.am:syncope-client-am-console (>=4.0.0, <=4.0.3), org.apache.syncope.client.idm:syncope-client-idm-console (>=4.0.0, <=4.0.3) +4 more potentially affected by CVE-2026-23795 via org.apache.syncope.client.idrepo:syncope-client-idrepo-console (>=4.0.0, <=4.0.3)

org.apache.syncope.client.idrepo:syncope-client-idrepo-console MAVEN version =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.3 Source cves: CVE-2026-23795 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPECLIENTIDREPO-15202477...

org.apache.syncope.client.am:syncope-client-am-console (>=3.0.0, <=3.0.15), org.apache.syncope.client.idm:syncope-client-idm-console (>=3.0.0, <=3.0.15) +4 more potentially affected by CVE-2026-23795 via org.apache.syncope.client.idrepo:syncope-client-idrepo-console (>=3.0.0, <=3.0.15)

org.apache.syncope.client.idrepo:syncope-client-idrepo-console MAVEN version =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.15 Source cves: CVE-2026-23795 Source advisory: MEND:CVE-2026-23795...

org.apache.syncope.client.am:syncope-client-am-console (>=4.0.0, <=4.0.3), org.apache.syncope.client.idm:syncope-client-idm-console (>=4.0.0, <=4.0.3) +4 more potentially affected by CVE-2026-23795 via org.apache.syncope.client.idrepo:syncope-client-idrepo-console (>=4.0.0, <=4.0.3)

org.apache.syncope.client.idrepo:syncope-client-idrepo-console MAVEN version =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.3 Source cves: CVE-2026-23795 Source advisory: MEND:CVE-2026-23795...

Flow code issues and vulnerabilities

Flow is a free and open-source enterprise-level process application developed by FlowwJ, a Chinese developer. It combines technologies such as Flowable to create an integrated process engine solution. There are code issues and vulnerabilities in Flow; these vulnerabilities stem from incorrect...