CVE-2026-109083: Apache Syncope: Remote Code Execution via Flowable JUEL expression

Published Nov 2, 2026

Updated

Improper isolation or compartmentalization vulnerability in Apache Syncope.

An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a JUEL expression is imported and started, the expression is executed directly on the server, with no sandbox.

This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0 through 4.1.3.

Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue by rejecting BPMN definitions including expression attributes.

Event History

Nov 2, 2026

CVE Published

via NVD·02:17 PM

Data Sourced

via NVD·02:17 PM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

An administrator with sufficient entitlements to import BPMN process definitions through the REST API can exploit it. The attacker must also be able to start the imported process.

What must an attacker do to trigger code execution?

The attacker imports a BPMN process definition containing a JUEL expression and starts that process. The expression is then executed directly on the Syncope server without sandboxing.

Which versions are affected and which versions contain the fix?

Affected releases are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, and 4.1.0 through 4.1.3. Upgrading to 4.0.9 or 4.1.4 addresses the issue by rejecting BPMN definitions that include expression attributes.

How can I tell whether my deployment is exposed?

Check whether the Syncope version falls within an affected range and whether administrative users have entitlements to import BPMN definitions via the REST API and start processes. A deployment meeting both conditions is exposed to exploitation by such an administrator.

CVE-2026-109083: Apache Syncope: Remote Code Execution via Flowable JUEL expression

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

What must an attacker do to trigger code execution?

Which versions are affected and which versions contain the fix?

How can I tell whether my deployment is exposed?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

What must an attacker do to trigger code execution?

Which versions are affected and which versions contain the fix?

How can I tell whether my deployment is exposed?