CVE-2026-42782: Apache Syncope sandbox escape via Groovy static initializer

CVE-2026-42782 · Severity: high · CVSS 7.2 · Published 2026-05-25

Apache Syncope, an open-source system for managing digital identities, contains a security flaw that could allow a high-level administrator to execute unauthorized code on the server. By creating a specially crafted script, an attacker with administrative access can bypass security restrictions to run commands outside of the intended protected environment. This could lead to a full takeover of the identity management system and access to sensitive user data.

Technologies: Apache Software Foundation Syncope. Vendors: Apache Software Foundation, Maven.

Quick answers

Is CVE-2026-42782 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42782 being exploited in the wild.
How severe is CVE-2026-42782?
High severity, with a CVSS score of 7.2, published 25 May 2026.
Which products and versions are affected?
Apache Software Foundation Syncope 3.0 through 3.0.16, 4.0 through 4.0.5, 4.1.0; org.apache.syncope.core:syncope-core-spring (Maven) ECOSYSTEM:introduced=3.0.0-M0,last_affected=3.0.16.
Is there a fix for CVE-2026-42782?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-42782 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-42782?
Check whether you run Apache Software Foundation Syncope or org.apache.syncope.core:syncope-core-spring (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper isolation vulnerability (CWE-653) exists in Apache Syncope's handling of Groovy implementations. While Groovy scripts are generally sandboxed, the static initializer of a Groovy class was not subject to the same restrictions. An attacker with administrative privileges ('Implementations' entitlements) can define a malicious Groovy class where the static initializer contains code that executes in a non-sandboxed path. This allows for post-authentication Remote Code Execution (RCE) on the underlying host. The vulnerability is addressed in versions 4.0.6 and 4.1.1 by ensuring static initializers are also executed within the sandbox.

Affected products

  • Apache Syncope 3.0 through 3.0.16, 4.0 through 4.0.5, 4.1.0

Identifiers

  • CVE-2026-42782
  • GHSA-gq7g-vg2q-jvq3

Timeline

  • 2026-05-25: disclosed
  • 2026-05-25: advisory: NVD and Apache mailing list publication
  • 2026-05-26: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.