CVE-2026-53421
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
An improper isolation or compartmentalization vulnerability exists in Apache Syncope. An administrator with adequate entitlements can achieve remote code execution through the connector subsystem by relying on scripted connectors (REST and SQL) to run Groovy scripts.
Risk Assessment
The risk is that an authorized administrator can execute remote code, potentially leading to full compromise of the Syncope system and impacting data confidentiality, integrity, and availability.
Recommendation
It is recommended to upgrade Apache Syncope to version 4.0.7 or 4.1.2 immediately, which fix this issue by hardening the Groovy security sandbox.
Original NVD description (English source)
Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve remote code execution through the connector subsystem by relying on scripted connectors' (REST and SQL) capability to run Groovy scripts. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue by hardening the Groovy security sandbox.