CVE-2026-77147: Apache Syncope: Groovy Sandbox escape for empty CommandArgs

Q: Which Apache Syncope versions are affected and what versions fix the issue?

Affected releases are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Upgrade to 4.0.8 or 4.1.3 to obtain the fix.

Published Sep 14, 2026

Updated

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Syncope.

An administrator with adequate entitlements for Implementations can create a malicious Groovy Command class containing untrusted code in their CommandArgs static implementation, bypassing the Groovy security sandbox.

This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2.

Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

Affected Software

2 affected components

Apache Syncope>=3.0.0-M0<3.0.16, >=4.0.0-M0<4.0.7, >=4.1.0-M0<4.1.2

Apache Syncope<=4.0.7, <=4.1.2, <=3.0.16

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Syncope to a version that resolves this vulnerability.
Fixed in 4.0.8
Upgrade
Upgrade Apache Syncope to a version that resolves this vulnerability.
Fixed in 4.1.3

Event History

Sep 14, 2026

CVE Published

via MITRE·12:49 PM

Data Sourced

via MITRE·12:49 PM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An administrator with adequate entitlements for Implementations can exploit it by creating a malicious Groovy Command class. The issue is therefore not described as exploitable by an unauthenticated or ordinary user.

Which Apache Syncope versions are affected and what versions fix the issue?

Affected releases are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Upgrade to 4.0.8 or 4.1.3 to obtain the fix.