CVE-2026-113687: Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypass

Published Nov 2, 2026

Updated

Improper isolation or compartmentalization vulnerability in Apache Syncope.

An administrator with adequate entitlements for Implementations can create a malicious Groovy class running untrusted code on a separate Thread, thus bypassing the Groovy security sandbox.

This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3.

Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.

Event History

Nov 2, 2026

CVE Published

via NVD·02:17 PM

Data Sourced

via NVD·02:17 PM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated Apache Syncope administrator with sufficient entitlements for Implementations can exploit it. The provided information does not indicate that lower-privileged users or unauthenticated attackers can do so.

What does exploitation require?

The attacker must be able to create a malicious Groovy class and run untrusted code on a separate thread. This bypasses the Groovy security sandbox and can lead to remote code execution.

Which releases need remediation?

Affected releases are Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, and 4.1.0-M0 through 4.1.3. Upgrade to 4.0.9 or 4.1.4 as applicable.

CVE-2026-113687: Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypass

Event History

Frequently Asked Questions

Who can exploit this issue?

What does exploitation require?

Which releases need remediation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What does exploitation require?

Which releases need remediation?