---
id: "CVE-2026-109083"
kind: "vulnerability"
aliases: ["CVE-2026-109083"]
title: "Apache Syncope: admin-imported BPMN processes run unsandboxed JUEL expressions on server"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-syncope", "identity-management", "java", "package", "self-hosted"]
not_affected_if: ["no-bpmn-import-rights", "unaffected-version"]
published_at: "2026-11-02T14:17:35+00:00"
first_seen_at: "2026-11-02T14:23:23+00:00"
updated_at: "2026-11-02T14:25:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109083", "first_seen_at": "2026-11-02T14:23:23+00:00"}]
---

# Apache Syncope: admin-imported BPMN processes run unsandboxed JUEL expressions on server

Apache Syncope lets an administrator import BPMN process definitions through its REST API and start them. A JUEL expression inside such a process is executed directly on the server with no sandbox, so an admin can run arbitrary code on the host.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Apache Syncope version in use; affected releases are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, and 4.1.0 through 4.1.3.
- Review which accounts hold entitlements to import BPMN definitions via the REST API.

## Fix

- Upgrade the 4.0 line to `4.0.9`.
- Upgrade the 4.1 line to `4.1.4`.
- The 3.0 line: unknown, the sources do not state a fixed 3.0 release.

## Timeline

- 2026-11-02T14:23:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109083

## From the sources

Improper isolation or compartmentalization vulnerability in Apache Syncope.

An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a JUEL expression is imported and started, the expression is executed directly on the server, with no sandbox.



This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0 through 4.1.3.



Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue by rejecting BPMN definitions including expression attributes.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_