As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-109083: Apache Syncope: Remote Code Execution via Flowable JUEL expression
Apache Syncope versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, and 4.1.0 through 4.1.3 are vulnerable to remote code execution through improper isolation of JUEL expressions in BPMN process definitions. An administrator with sufficient privileges can import malicious process definitions via the REST application programming interface (API) and trigger execution of arbitrary code.
Why it matters: Syncope administrators and organizations running affected versions face RCE risk from privileged internal users; patch immediately or restrict who can import BPMN processes.
- Source published
- First seen by Cybersecurity Tracker