Description
Improper Isolation or Compartmentalization vulnerability in Apache Syncope.



An administrator with adequate entitlements can achieve remote code execution through the connector subsystem by relying on scripted connectors' (REST and SQL) capability to run Groovy scripts.

This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1.




Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue by hardening the Groovy security sandbox.
Published: 2026-07-20
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An administrator with adequate entitlements can achievecope’s connector subsystem by exploiting Groovy scripts in scripted connectors such as REST and SQL. The vulnerability is due to improper isolation or compartmentalization, allowing arbitrary code execution under the privileges of the authenticated user. This weakness is identified as CWE-653, which involves failure to restrict the use of a function or library to a safe domain.

Affected Systems

Apache Syncope versions from 3.0.0‑M0 through 3.0.16, from 4.0.0‑M0 through 4.0.6, and from 4.1.0‑M0 through 4.1.1 are affected. The product is provided by the Apache Software Foundation.

Risk and Exploitability

The EPSS score is < 1% and the vulnerability is not listed in KEV. Because remote code execution is possible, the risk remains high, especially when an attacker can obtain administrative privileges. The CVSS score is 9.8. Attacks would require exploitation of the scripted connector functionality, which may be triggered remotely through the connector API.

Generated by OpenCVE AI on July 30, 2026 at 19:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Apache Syncope to version 4.0.7 or newer, or 4.1.2 or newer, which hardens the Groovy security sandbox and removes the remote code execution path.
  • If an upgrade cannot be performed immediately, disable or remove all scripted connector configurations (REST or SQL) that allow Groovy script execution.
  • Review and restrict user entitlements to limit administrative access to the connector subsystem.

Generated by OpenCVE AI on July 30, 2026 at 19:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 21 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 00:30:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache syncope
Vendors & Products Apache
Apache syncope

Mon, 20 Jul 2026 14:45:00 +0000

Type Values Removed Values Added
Description Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve remote code execution through the connector subsystem by relying on scripted connectors' (REST and SQL) capability to run Groovy scripts. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue by hardening the Groovy security sandbox.
Title Apache Syncope: Remote Code Execution via Scripted Connector
Weaknesses CWE-653
References

Subscriptions

Apache Syncope
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-07-21T14:57:20.891Z

Reserved: 2026-06-09T10:22:09.599Z

Link: CVE-2026-53421

cve-icon Vulnrichment

Updated: 2026-07-20T18:38:14.593Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-30T19:30:09Z

Weaknesses
  • CWE-653

    Improper Isolation or Compartmentalization