Live › vulnerability › CVE-2026-113687
An administrator with entitlements for Implementations can create a Groovy class that runs untrusted code on a separate thread, bypassing the Groovy security sandbox. The attacker gets arbitrary code execution in the Syncope process beyond what the sandbox was meant to allow.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 14:23 UTC. All times on this page are UTC.
Only deployments of Apache Syncope in the listed affected ranges are exposed. The risk requires an administrator account with entitlements for Implementations, so teams that restrict those entitlements to a small trusted group have a smaller exposure. Deployments on 3.0.17 or later in the 3.0 line, 4.0.9 or later in the 4.0 line, or 4.1.4 or later in the 4.1 line are not affected.
No product ranges from the sources yet.
unknown if not visible, otherwise compare against the affected ranges 3.0.0-M0 to 3.0.16, 4.0.0-M0 to 4.0.8, and 4.1.0-M0 to 4.1.3.4.0.9 (for the 4.0 line)4.1.4 (for the 4.1 line)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper isolation or compartmentalization vulnerability in Apache Syncope.
An administrator with adequate entitlements for Implementations can create a malicious Groovy class running untrusted code on a separate Thread, thus bypassing the Groovy security sandbox.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3.
Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-113687")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.