CVE-2026-113687

Apache Syncope is vulnerable to a remote code execution (RCE) flaw due to improper isolation or compartmentalization (CWE-653). An administrator with adequate entitlements for Implementations can create a malicious Groovy class that runs untrusted code on a separate thread, successfully bypassing...

CVE-2026-113687 Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypass

Improper isolation or compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class running untrusted code on a separate Thread, thus bypassing the Groovy security sandbox. This issue affects Apache Syncop...

PT-2026-91197

Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy Command class containing untrusted code in their CommandArgs static implementation, bypassing the Groovy security...

CVE-2026-63071

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through...