CVE-2026-77147: Apache Syncope: Groovy Sandbox escape for empty CommandArgs
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Syncope.
An administrator with adequate entitlements for Implementations can create a malicious Groovy Command class containing untrusted code in their CommandArgs static implementation, bypassing the Groovy security sandbox.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2.
Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Syncopeto a version that resolves this vulnerability.Fixed in 4.0.8 - Upgrade
Upgrade
Apache Syncopeto a version that resolves this vulnerability.Fixed in 4.1.3 - Compensating control
Since the Groovy sandbox escape can occur via a malicious Groovy Command class crafted by an administrator with adequate entitlements, restrict administrative/entitlement access to trusted users only to reduce the risk of untrusted Groovy CommandArgs code being executed.
Event History
Frequently Asked Questions
Who can exploit this issue?
An administrator with adequate entitlements for Implementations can exploit it by creating a malicious Groovy Command class. The issue is therefore not described as exploitable by an unauthenticated or ordinary user.
Which Apache Syncope versions are affected and what versions fix the issue?
Affected releases are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Upgrade to 4.0.8 or 4.1.3 to obtain the fix.