{"id":"CVE-2026-113687","kind":"vulnerability","aliases":["CVE-2026-113687"],"related":[],"title":"Apache Syncope: admin-created Groovy class escapes sandbox by running on new thread","description":"Improper isolation or compartmentalization vulnerability in Apache Syncope.\n\n\n\nAn administrator with adequate entitlements for Implementations can create a malicious Groovy class running untrusted code on a separate Thread, thus bypassing the Groovy security sandbox.\n\n\n\nThis issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3.\n\n\n\nUsers are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.","summary":"An administrator with entitlements for Implementations can create a Groovy class that runs untrusted code on a separate thread, bypassing the Groovy security sandbox. The attacker gets arbitrary code execution in the Syncope process beyond what the sandbox was meant to allow.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-syncope","groovy","identity-management","java","package"],"not_affected_if":["fixed-version","no-implementation-entitlements"],"how_to_check":"- Check the Apache Syncope version in use: `unknown` if not visible, otherwise compare against the affected ranges 3.0.0-M0 to 3.0.16, 4.0.0-M0 to 4.0.8, and 4.1.0-M0 to 4.1.3.\n- Check which accounts hold entitlements for Implementations in the Syncope admin console.","fix":"- Apache Syncope `4.0.9` (for the 4.0 line)\n- Apache Syncope `4.1.4` (for the 4.1 line)","status":"open","published_at":"2026-11-02T14:17:35+00:00","first_seen_at":"2026-11-02T14:23:23+00:00","triaged_at":"2026-11-02T14:24:56+00:00","updated_at":"2026-11-02T14:24:56+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-02T14:24:56Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Syncope `4.0.9` (for the 4.0 line)\n- Apache Syncope `4.1.4` (for the 4.1 line)","reach":"network","title":"Apache Syncope: admin-created Groovy class escapes sandbox by running on new thread","impact":"high","summary":"An administrator with entitlements for Implementations can create a Groovy class that runs untrusted code on a separate thread, bypassing the Groovy security sandbox. The attacker gets arbitrary code execution in the Syncope process beyond what the sandbox was meant to allow.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-syncope","java","groovy","identity-management"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Untrusted code runs on the Syncope server outside the sandbox","analyst_note":"","how_to_check":"- Check the Apache Syncope version in use: `unknown` if not visible, otherwise compare against the affected ranges 3.0.0-M0 to 3.0.16, 4.0.0-M0 to 4.0.8, and 4.1.0-M0 to 4.1.3.\n- Check which accounts hold entitlements for Implementations in the Syncope admin console.","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-version","no-implementation-entitlements"],"who_is_affected":"Only deployments of Apache Syncope in the listed affected ranges are exposed. The risk requires an administrator account with entitlements for Implementations, so teams that restrict those entitlements to a small trusted group have a smaller exposure. Deployments on 3.0.17 or later in the 3.0 line, 4.0.9 or later in the 4.0 line, or 4.1.4 or later in the 4.1 line are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000756,"input_tokens":4200,"output_tokens":672,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-113687':17A,20A '-2026':16A,19A '3.0.0':112C '3.0.16':115C '4.0.0':117C '4.0.8':120C '4.0.9':133C '4.1.0':122C '4.1.3':125C '4.1.4':134C 'adequ':83C 'admin':4A 'admin-cr':3A 'administr':31B,81C 'affect':108C 'allow':71B 'apach':1A,22B,78C,109C 'apache-syncop':21B 'arbitrari':57B 'attack':55B 'beyond':64B 'bypass':49B,101C 'class':7A,40B,92C 'code':44B,58B,95C 'compartment':75C 'creat':5A,37B,88C 'cve':15A,18A 'entitl':33B,84C 'escap':8A 'execut':59B 'fix':136C 'get':56B 'groovi':6A,24B,39B,51B,91C,103C 'ident':26B 'identity-manag':25B 'implement':35B,86C 'improp':72C 'isol':73C 'issu':107C,138C 'java':28B 'm0':113C,118C,123C 'malici':90C 'manag':27B 'meant':69B 'new':13A 'packag':29B 'process':63B 'recommend':128C 'run':11A,42B,93C 'sandbox':9A,53B,67B,105C 'secur':52B,104C 'separ':47B,98C 'syncop':2A,23B,62B,79C,110C 'thread':14A,48B,99C 'thus':100C 'untrust':43B,94C 'upgrad':130C 'user':126C 'version':132C 'vulner':76C","nicknames":[],"mitigations":[],"who_affected":"Only deployments of Apache Syncope in the listed affected ranges are exposed. The risk requires an administrator account with entitlements for Implementations, so teams that restrict those entitlements to a small trusted group have a smaller exposure. Deployments on 3.0.17 or later in the 3.0 line, 4.0.9 or later in the 4.0 line, or 4.1.4 or later in the 4.1 line are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apachesyncope","groovy","identitymanagement","java","package","unknown"],"first_public_at":"2026-11-02T14:17:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113687","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113687","severity":null,"published_at":"2026-11-02T14:17:35+00:00","modified_at":"2026-11-02T14:17:35+00:00","first_seen_at":"2026-11-02T14:23:23+00:00","fetched_at":"2026-11-02T14:23:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}