As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-113687: Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypass
Apache Syncope contains a remote code execution (RCE) vulnerability affecting versions 3.0.0 through 4.1.3, in which an administrator with adequate entitlements can create a malicious Groovy class that bypasses the security sandbox by executing untrusted code on a separate thread. The flaw stems from improper isolation or compartmentalization of Groovy method execution.
Why it matters: Administrators of affected Syncope instances must patch immediately, as authenticated admins with implementation entitlements can achieve code execution on the server.
- Source published
- First seen by Cybersecurity Tracker