CVE-2026-42782
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can create a malicious Groovy class containing untrusted code reaching a non-sandboxed execution path via the class static initializer. This affects versions 3.0 through 3.0.16, 4.0 through 4.0.5, and 4.1.0. Fixed in 4.0.6 and 4.1.1.
Risk Assessment
An administrator can execute arbitrary code outside the sandbox, leading to full server compromise and data breach.
Recommendation
Immediately upgrade Apache Syncope to version 4.0.6 or 4.1.1. Also restrict administrator privileges to the minimum necessary.
Other vulnerabilities in Apache Syncope
See all- CVE-2026-63071Critical
An Improper Isolation or Compartmentalization vulnerability in Apache Syncope allows an administrator with adequate entitlements to create a malicious Groovy class containing untrusted code, bypassing the Groovy security sandbox.
- CVE-2026-62183Critical
An improper privilege management vulnerability exists in Apache Syncope. A user can exploit a REST API call to grant themselves administrative roles, gaining full control over the system. Affected versions: 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1.
- CVE-2026-57308Critical
An SQL Injection vulnerability in Apache Syncope allows an administrator with adequate entitlements to execute arbitrary SQL via stacked queries using unsanitized sort parameters. Affected versions: 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1.
- CVE-2026-53421Critical
An improper isolation or compartmentalization vulnerability exists in Apache Syncope. An administrator with adequate entitlements can achieve remote code execution through the connector subsystem by relying on scripted connectors (REST and SQL) to run Groovy scripts.
- CVE-2026-53405Critical
A vulnerability in Apache Syncope allows improper isolation of Groovy scripts in BPMN processes. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and start them, causing the Groovy script to execute directly on the server without a sandbox.
- CVE-2026-62418High
An authenticated Server-Side Request Forgery (SSRF) vulnerability with low privileges was found in Apache Syncope via Connectors and Resources check. It allows an attacker to send requests from the server to internal systems.
- CVE-2026-42797Medium
Apache Syncope versions 3.0 to 3.0.16, 4.0 to 4.0.5, and 4.1.0 have a sensitive information disclosure vulnerability via malicious JEXL expressions in Derived Schemas. An administrator with sufficient entitlements can access user-related security-sensitive information.
Original NVD description (English source)
Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code reaching a non-sandboxed execution path via the class static initializer. This issue affects Apache Syncope: 3.0 through 3.0.16, 4.0 through 4.0.5, 4.1.0. Users are recommended to upgrade to version 4.0.6 / 4.1.1, which fix this issue by forcing even the static initializer in Groovy code to run in a sandbox.