CVE-2026-63071: Apache Syncope: RCE via Groovy Sandbox bypass
Improper Isolation or Compartmentalization vulnerability in Apache Syncope.
An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code bypassing the Groovy security sandbox.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.6, from 4.1.0-M0 through 4.1.1.
Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue by tightening the Groovy security sandbox.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Syncopeto a version that resolves this vulnerability.Fixed in 4.0.7 - Upgrade
Upgrade
Apache Syncopeto a version that resolves this vulnerability.Fixed in 4.1.2 - Compensating control
Restrict access to the functionality that allows administrators/entitled users to create Groovy classes containing untrusted code, since an administrator with adequate entitlements can bypass the Groovy security sandbox.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63071?
CVE-2026-63071 has a risk score of 30, indicating a significant security threat.
What type of vulnerability is CVE-2026-63071?
CVE-2026-63071 is an improper isolation or compartmentalization vulnerability that allows remote code execution.
How can an attacker exploit CVE-2026-63071?
An attacker can exploit CVE-2026-63071 by creating a malicious Groovy class to bypass the Groovy security sandbox.
Which versions of Apache Syncope are affected by CVE-2026-63071?
CVE-2026-63071 affects Apache Syncope versions from 3.0.0-M0 onward.
How do I fix CVE-2026-63071?
To fix CVE-2026-63071, upgrade to the latest patched version of Apache Syncope.