Executive brief
Apache Syncope, an open-source system for managing digital identities, contains a security flaw that allows authorized administrators to execute unauthorized code on the server. By importing and starting a specially crafted business process (BPMN) definition, an attacker can run arbitrary scripts directly on the underlying system. This could lead to a complete takeover of the server, data theft, or disruption of identity management services.
Technical details
An improper isolation vulnerability exists in Apache Syncope's integration with the Flowable BPMN engine. An administrator with sufficient entitlements can use the REST API to import a BPMN process definition that includes a 'scriptTask' containing Groovy code. Because these scripts are executed directly on the server without a security sandbox, an attacker can achieve remote code execution (RCE) in the context of the Syncope application. The issue is resolved in versions 4.0.7 and 4.1.2 by implementing a security sandbox for Flowable's Groovy scriptTasks.
Affected products
- Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, 4.1.0-M0 through 4.1.1
Timeline
- 2026-07-20: advisory
- 2026-07-20: disclosed