PUBLISHED
2026-07-20 15:16
MODIFIED
2026-07-20 15:16
EPSS (Prob. Exploit)
0.75%
Top 45.0%
> DESCRIPTION
Improper Isolation or Compartmentalization vulnerability in Apache Syncope.
An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code bypassing the Groovy security sandbox.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.6, from 4.1.0-M0 through 4.1.1.
Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue by tightening the Groovy security sandbox.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-653: Improper Isolation or Compartmentalization - The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache Syncope: RCE via Groovy Sandbox bypass
AFFECTED PACKAGES:
Unknown / Unknown
25 versions affected
> HISTORIQUE DES MODIFICATIONS
Première apparition
20/07/2026 15:16
Source: NVD
📊
ENRICHISSEMENT
01/08/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-653: Improper Isolation or Compartmentalization - The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, ...
Total des modifications: 1
Dernière mise à jour: 3 months ago