{"id":"CVE-2026-109083","kind":"vulnerability","aliases":["CVE-2026-109083"],"related":[],"title":"Apache Syncope: admin-imported BPMN processes run unsandboxed JUEL expressions on server","description":"Improper isolation or compartmentalization vulnerability in Apache Syncope.\n\nAn administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a JUEL expression is imported and started, the expression is executed directly on the server, with no sandbox.\n\n\n\nThis issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0 through 4.1.3.\n\n\n\nUsers are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue by rejecting BPMN definitions including expression attributes.","summary":"Apache Syncope lets an administrator import BPMN process definitions through its REST API and start them. A JUEL expression inside such a process is executed directly on the server with no sandbox, so an admin can run arbitrary code on the host.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-syncope","identity-management","java","package","self-hosted"],"not_affected_if":["no-bpmn-import-rights","unaffected-version"],"how_to_check":"- Check the Apache Syncope version in use; affected releases are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, and 4.1.0 through 4.1.3.\n- Review which accounts hold entitlements to import BPMN definitions via the REST API.","fix":"- Upgrade the 4.0 line to `4.0.9`.\n- Upgrade the 4.1 line to `4.1.4`.\n- The 3.0 line: unknown, the sources do not state a fixed 3.0 release.","status":"open","published_at":"2026-11-02T14:17:35+00:00","first_seen_at":"2026-11-02T14:23:23+00:00","triaged_at":"2026-11-02T14:25:01+00:00","updated_at":"2026-11-02T14:25:01+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-02T14:25:01Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the 4.0 line to `4.0.9`.\n- Upgrade the 4.1 line to `4.1.4`.\n- The 3.0 line: unknown, the sources do not state a fixed 3.0 release.","reach":"network","title":"Apache Syncope: admin-imported BPMN processes run unsandboxed JUEL expressions on server","impact":"high","summary":"Apache Syncope lets an administrator import BPMN process definitions through its REST API and start them. A JUEL expression inside such a process is executed directly on the server with no sandbox, so an admin can run arbitrary code on the host.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-syncope","java","identity-management","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Admin-level user runs arbitrary code on the Syncope server","analyst_note":"Confirm whether 3.0 has a fixed release and whether BPMN import is enabled by default; check the Apache Syncope advisory for the official fix statement.","how_to_check":"- Check the Apache Syncope version in use; affected releases are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, and 4.1.0 through 4.1.3.\n- Review which accounts hold entitlements to import BPMN definitions via the REST API.","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version","no-bpmn-import-rights"],"who_is_affected":"Only deployments of Apache Syncope in the listed ranges are exposed, and only through administrators who can import and start BPMN processes via the REST API. Teams not running Syncope, or that restrict those entitlements tightly, have less exposure. The sources do not describe a default-config trigger.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00076,"input_tokens":4235,"output_tokens":673,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-109083':16A,19A '-2026':15A,18A '3.0.0':130C '3.0.16':133C '4.0.0':135C '4.0.8':138C '4.0.9':150C '4.1.0':140C '4.1.3':142C '4.1.4':151C 'adequ':84C 'admin':4A,65B 'admin-import':3A 'administr':35B,82C 'affect':126C 'apach':1A,21B,31B,79C,127C 'apache-syncop':20B 'api':43B,95C 'arbitrari':68B,88C 'attribut':162C 'bpmn':6A,37B,89C,103C,158C 'code':69B 'compartment':76C 'contain':105C 'cve':14A,17A 'definit':39B,91C,159C 'direct':56B,117C 'entitl':85C 'execut':55B,116C 'express':11A,49B,108C,114C,161C 'fix':153C 'host':30B,72B 'ident':24B 'identity-manag':23B 'import':5A,36B,87C,110C 'improp':73C 'includ':160C 'insid':50B 'isol':74C 'issu':125C,155C 'java':26B 'juel':10A,48B,107C 'let':33B 'm0':131C,136C 'manag':25B 'packag':27B 'process':7A,38B,53B,90C,100C,104C 'recommend':145C 'reject':157C 'rest':42B,94C 'run':8A,67B 'sandbox':62B,123C 'self':29B 'self-host':28B 'server':13A,59B,120C 'start':45B,98C,112C 'syncop':2A,22B,32B,80C,128C 'unsandbox':9A 'upgrad':147C 'user':143C 'version':149C 'via':92C 'vulner':77C","nicknames":[],"mitigations":[],"who_affected":"Only deployments of Apache Syncope in the listed ranges are exposed, and only through administrators who can import and start BPMN processes via the REST API. Teams not running Syncope, or that restrict those entitlements tightly, have less exposure. The sources do not describe a default-config trigger.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apachesyncope","high","identitymanagement","java","package","selfhosted"],"first_public_at":"2026-11-02T14:17:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109083","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109083","severity":null,"published_at":"2026-11-02T14:17:35+00:00","modified_at":"2026-11-02T14:17:35+00:00","first_seen_at":"2026-11-02T14:23:23+00:00","fetched_at":"2026-11-02T14:23:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}