CVE-2026-113687 Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypass

Improper isolation or compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class running untrusted code on a separate Thread, thus bypassing the Groovy security sandbox. This issue affects Apache Syncop...

CVE-2026-113687

Apache Syncope is vulnerable to a remote code execution (RCE) flaw due to improper isolation or compartmentalization (CWE-653). An administrator with adequate entitlements for Implementations can create a malicious Groovy class that runs untrusted code on a separate thread, successfully bypassing...

CVE-2026-63071

Apache Syncope is vulnerable to an Improper Isolation or Compartmentalization flaw due to a bypass in the Groovy security sandbox (specifically the GroovySandboxScriptEngineImpl in the core/spring module). An administrator with entitlements to manage Implementations can create a malicious Groovy ...