Live › vulnerability › CVE-2026-109083
Apache Syncope lets an administrator import BPMN process definitions through its REST API and start them. A JUEL expression inside such a process is executed directly on the server with no sandbox, so an admin can run arbitrary code on the host.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 14:23 UTC. All times on this page are UTC.
Only deployments of Apache Syncope in the listed ranges are exposed, and only through administrators who can import and start BPMN processes via the REST API. Teams not running Syncope, or that restrict those entitlements tightly, have less exposure. The sources do not describe a default-config trigger.
No product ranges from the sources yet.
4.0.9.4.1.4.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper isolation or compartmentalization vulnerability in Apache Syncope.
An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a JUEL expression is imported and started, the expression is executed directly on the server, with no sandbox.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0 through 4.1.3.
Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue by rejecting BPMN definitions including expression attributes.
This page as .md · .json · in your agent: get_signal("CVE-2026-109083")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.