Executive brief
Apache Syncope, an open-source system for managing digital identities, is vulnerable to a security bypass. An administrator with specific permissions can execute unauthorized code by bypassing the system's safety boundaries (sandbox). This could allow an internal attacker to gain deeper access to the underlying server or manipulate identity data beyond their intended authority.
Technical details
An Improper Isolation or Compartmentalization vulnerability (CWE-653) exists in Apache Syncope's Groovy implementation. The root cause is an insufficiently restrictive Groovy security sandbox. An attacker with administrative 'Implementations' entitlements can create a malicious Groovy class that bypasses the sandbox to execute untrusted code on the host system. This vulnerability affects versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1. The issue is resolved in versions 4.0.7 and 4.1.2 by tightening the sandbox constraints.
Affected products
- Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, 4.1.0-M0 through 4.1.1
Timeline
- 2026-07-20: disclosed
- 2026-07-20: advisory