Executive brief
Apache Syncope is an open-source identity and access management system. An authenticated administrator can exploit a Groovy sandbox bypass to inject and execute arbitrary code on the server by creating a malicious Command class, potentially compromising the entire identity management infrastructure and any dependent systems.
Technical details
This vulnerability is a code injection flaw in Apache Syncope's Groovy script execution mechanism. An administrator with sufficient entitlements can craft a malicious Groovy Command class that bypasses the sandbox security restrictions by embedding untrusted code in the CommandArgs static implementation. The attack requires administrator-level access and allows arbitrary code execution on the server. The vulnerability affects versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Patches are available in versions 4.0.8 and 4.1.3.
Affected products
- Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, 4.1.0-M0 through 4.1.2
Timeline
- 2026-09-14: disclosed
- 2026-09-14: patched: Fixed in versions 4.0.8 and 4.1.3