CVE-2026-42782— Apache Syncope: Post-auth RCE via Groovy static
Quick assessment
Affected
Apache Software Foundation Apache Syncope
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Syncope是美国阿帕奇（Apache）基金会的一套用于企业环境中的开源数字身份管理系统。该系统支持身份管理、角色配置等。 Apache Syncope 3.0版本至3.0.16版本、4.0版本至4.0.5版本和4.1.0版本存在安全漏洞，该漏洞源于隔离或分区不当，可能导致具有足够权限的管理员创建包含非沙盒执行路径的恶意Groovy类。
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting InterpreterAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache Syncope | 3.0≤ 3.0.16 |
affected |
4.0≤ 4.0.5 |
affected | ||
4.1≤ 4.1.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-42782
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Syncope: Post-auth RCE via Groovy static
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Isolation or Compartmentalization vulnerability in Apache Syncope.
An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code reaching a non-sandboxed execution path via the class static initializer.
This issue affects Apache Syncope: 3.0 through 3.0.16, 4.0 through 4.0.5, 4.1.0.
Users are recommended to upgrade to version 4.0.6 / 4.1.1, which fix this issue by forcing even the static initializer in Groovy code to run in a sandbox.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的划分
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Syncope 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Syncope是美国阿帕奇（Apache）基金会的一套用于企业环境中的开源数字身份管理系统。该系统支持身份管理、角色配置等。 Apache Syncope 3.0版本至3.0.16版本、4.0版本至4.0.5版本和4.1.0版本存在安全漏洞，该漏洞源于隔离或分区不当，可能导致具有足够权限的管理员创建包含非沙盒执行路径的恶意Groovy类。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Syncope | 3.0 ~ 3.0.16 | - |
|
II. Public POCs for CVE-2026-42782
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-42782
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-42782 (1)
Same Patch Batch · Apache Software Foundation · 2026-05-25 · 9 CVEs total
| CVE-2026-48589 | Apache Shiro: Jakarta EE open redirect via untrusted Referer in post-login redirect flow | |
| CVE-2026-44598 | Apache Shiro Jakarta EE module: Open redirect and SSRF (requires valid credentials) | |
| CVE-2026-43828 | Apache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by | |
| CVE-2026-43827 | Apache Shiro: Session fixation: new session is not created after login by default | |
| CVE-2026-42797 | Apache Syncope: JexlContextBuilder Information Disclosure | |
| CVE-2026-46745 | Apache Airflow FAB provider: LDAP Filter Injection in FAB Auth Manager _search_ldap reacha | |
| CVE-2026-45361 | Apache Airflow Google provider: SSH host key verification disabled in ComputeEngineSSHHook | |
| CVE-2026-45249 | Apache ECharts: XSS in Lines series tooltip rendering |
IV. Related Vulnerabilities
Same product: Apache Syncope
-
CVE-2026-73191
Apache Syncope: CAS service URL injection via Forwarded HTTP -
CVE-2026-73195
Apache Syncope: CSV export spreadsheet formula injection -
CVE-2026-73236
Apache Syncope: Cross-Realm authorization bypass in delegate -
CVE-2026-73370
Apache Syncope: Cross-Realm boundaries reconciliation bypass -
CVE-2026-73178
Apache Syncope: JWT Access Token takeover
Same vendor: Apache Software Foundation
-
CVE-2026-95616
Apache WSS4J: Unauthenticated denial of service via integer -
CVE-2026-92899
Apache WSS4J: UsernameToken replay protection bypassed by re -
CVE-2026-92121
Apache WSS4J: WS-SecurityPolicy signature checks skipped in -
CVE-2026-89238
Apache WSS4J: WSS4J EncryptedHeader child confusion causing -
CVE-2026-88920
Apache WSS4J: SAML Sender-Vouches Authentication Bypass
Same weakness: CWE-653
-
CVE-2026-97029
Flatpak: flatpak: sandboxed app can signal unsandboxed proce -
CVE-2026-101078
deepseek-ai deepseek-harness Landlock Backend profiles.ts is -
CVE-2026-95699
MrSteam iSteamX Improper Isolation or Compartmentalization -
CVE-2026-57135
PraisonAI SandboxExecutor network-isolated mode does not blo -
CVE-2026-15366
Vivo Kids Mode 权限许可和访问控制问题漏洞
V. Comments for CVE-2026-42782
No comments yet