CVE-2026-42782: Apache Syncope: Post-auth RCE via Groovy static
Improper Isolation or Compartmentalization vulnerability in Apache Syncope.
An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code reaching a non-sandboxed execution path via the class static initializer.
This issue affects Apache Syncope: 3.0 through 3.0.16, 4.0 through 4.0.5, 4.1.0.
Users are recommended to upgrade to version 4.0.6 / 4.1.1, which fix this issue by forcing even the static initializer in Groovy code to run in a sandbox.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Syncopeto a version that resolves this vulnerability.Fixed in 4.0.6 - Upgrade
Upgrade
Apache Syncopeto a version that resolves this vulnerability.Fixed in 4.1.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42782?
CVE-2026-42782 has a severity rating of high with a CVSS score of 7.2.
How does CVE-2026-42782 affect Apache Syncope?
CVE-2026-42782 allows an authenticated administrator to execute arbitrary code due to improper isolation of Groovy classes.
What are the potential impacts of CVE-2026-42782?
Exploitation of CVE-2026-42782 could lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system.
Who is affected by CVE-2026-42782?
Any organizations using Apache Syncope with implementations relying on Groovy scripts by administrators may be affected by CVE-2026-42782.
How can I mitigate CVE-2026-42782?
To mitigate CVE-2026-42782, ensure that adequate access controls are enforced and monitor for unauthorized Groovy class usage.