CVE-2026-53405: Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask
Improper Isolation or Compartmentalization vulnerability in Apache Syncope.
An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a Groovy scriptTask is imported and started, the Groovy script is executed directly on the server, with no sandbox.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1.
Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue by wrapping Flowable's Groovy scriptTasks with security sandbox.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Syncopeto a version that resolves this vulnerability.Fixed in 4.0.7 - Upgrade
Upgrade
Apache Syncopeto a version that resolves this vulnerability.Fixed in 4.1.2 - Compensating control
Ensure the ability for administrators to import and start BPMN process definitions via the Syncope REST API is restricted to trusted, adequately entitled users only.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53405?
CVE-2026-53405 has a risk rating of 30, indicating a significant vulnerability in Apache Syncope.
How do I fix CVE-2026-53405?
To mitigate CVE-2026-53405, restrict access to the REST API and implement proper authentication and authorization controls.
What type of vulnerability is CVE-2026-53405?
CVE-2026-53405 is an Improper Isolation or Compartmentalization vulnerability affecting Apache Syncope.
What can an attacker achieve with CVE-2026-53405?
An attacker with administrative privileges can exploit CVE-2026-53405 to perform Remote Code Execution by importing arbitrary BPMN process definitions.
When was CVE-2026-53405 published?
CVE-2026-53405 was published on July 20, 2026.