PUBLISHED
2026-07-20 15:16
MODIFIED
2026-07-20 15:16
EPSS (Prob. Exploit)
0.75%
Top 45.2%
> DESCRIPTION
Improper Isolation or Compartmentalization vulnerability in Apache Syncope.
An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a Groovy scriptTask is imported and started, the Groovy script is executed directly on the server, with no sandbox.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1.
Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue by wrapping Flowable's Groovy scriptTasks with security sandbox.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-653: Improper Isolation or Compartmentalization - The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask
AFFECTED PACKAGES:
Unknown / Unknown
25 versions affected
> HISTORIQUE DES MODIFICATIONS
Première apparition
20/07/2026 15:16
Source: NVD
📊
ENRICHISSEMENT
01/08/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-653: Improper Isolation or Compartmentalization - The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, ...
Total des modifications: 1
Dernière mise à jour: 3 months ago