PUBLISHED
2026-07-20 15:16
MODIFIED
2026-07-20 15:16
EPSS (Prob. Exploit)
1.14%
Top 33.4%
> DESCRIPTION
Improper Isolation or Compartmentalization vulnerability in Apache Syncope.
An administrator with adequate entitlements can achieve remote code execution through the connector subsystem by relying on scripted connectors' (REST and SQL) capability to run Groovy scripts.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1.
Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue by hardening the Groovy security sandbox.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-653: Improper Isolation or Compartmentalization - The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache Syncope: Remote Code Execution via Scripted Connector
AFFECTED PACKAGES:
Unknown / Unknown
25 versions affected
> HISTORIQUE DES MODIFICATIONS
Première apparition
20/07/2026 15:16
Source: NVD
📊
ENRICHISSEMENT
01/08/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-653: Improper Isolation or Compartmentalization - The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, ...
Total des modifications: 1
Dernière mise à jour: 3 months ago