CVE-2026-53405— Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask
Quick assessment
Affected
Apache Software Foundation Apache Syncope
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache syncope是美国Apache基金会开源的一套身份管理自动化工具。 Apache Syncope 3.0.0-M0至3.0.16版本、4.0.0-M0至4.0.6版本、4.1.0-M0至4.1.1版本存在权限许可和访问控制问题漏洞，该漏洞源于隔离或分区化不当，管理员可通过REST API导入任意BPMN流程定义并启动，当包含Groovy scriptTask的BPMN流程被导入和启动时，Groovy脚本直接在服务器上执行且没有沙箱保护。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache Syncope | 3.0.0-M0≤ 3.0.16 |
affected |
4.0.0-M0≤ 4.0.6 |
affected | ||
4.1.0-M0≤ 4.1.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-53405
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Isolation or Compartmentalization vulnerability in Apache Syncope.
An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a Groovy scriptTask is imported and started, the Groovy script is executed directly on the server, with no sandbox.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1.
Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue by wrapping Flowable's Groovy scriptTasks with security sandbox.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的划分
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Syncope 权限许可和访问控制问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache syncope是美国Apache基金会开源的一套身份管理自动化工具。 Apache Syncope 3.0.0-M0至3.0.16版本、4.0.0-M0至4.0.6版本、4.1.0-M0至4.1.1版本存在权限许可和访问控制问题漏洞，该漏洞源于隔离或分区化不当，管理员可通过REST API导入任意BPMN流程定义并启动，当包含Groovy scriptTask的BPMN流程被导入和启动时，Groovy脚本直接在服务器上执行且没有沙箱保护。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Syncope | 3.0.0-M0 ~ 3.0.16 | - |
|
II. Public POCs for CVE-2026-53405
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-53405
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-53405 (1)
Same Patch Batch · Apache Software Foundation · 2026-07-20 · 10 CVEs total
| CVE-2026-56452 | 7.5 HIGH | Apache MINA SSHD: Path traversal in SCP file reception |
| CVE-2026-56624 | 7.3 HIGH | Apache MINA SSHD: SSH certificate options lack validations |
| CVE-2026-56623 | 7.1 HIGH | Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git on Windows |
| CVE-2026-58624 | 5.4 MEDIUM | Apache MINA SSHD: Remote execution of JGit commands can write files on the server |
| CVE-2026-63071 | Apache Syncope: RCE via Groovy Sandbox bypass | |
| CVE-2026-53421 | Apache Syncope: Remote Code Execution via Scripted Connector | |
| CVE-2026-57308 | Apache Syncope: SQL injection vulnerability in Audit Events search | |
| CVE-2026-62183 | Apache Syncope: User self-service privilege escalation | |
| CVE-2026-62418 | Apache Syncope: Low-privileged authenticated SSRF in Connectors and Resources check |
IV. Related Vulnerabilities
Same product: Apache Syncope
-
CVE-2026-73191
Apache Syncope: CAS service URL injection via Forwarded HTTP -
CVE-2026-73195
Apache Syncope: CSV export spreadsheet formula injection -
CVE-2026-73236
Apache Syncope: Cross-Realm authorization bypass in delegate -
CVE-2026-73370
Apache Syncope: Cross-Realm boundaries reconciliation bypass -
CVE-2026-73178
Apache Syncope: JWT Access Token takeover
Same vendor: Apache Software Foundation
-
CVE-2026-70410
Apache Calcite Avatica: Unrestricted class initialization wh -
CVE-2026-94301
Apache MINA: CVE-2026-47065 resolveProxyClass fix missing fr -
CVE-2026-86473
Apache Airflow: Logout ignores a presented Authorization bea -
CVE-2026-75158
Apache Airflow: Assets events API returns asset events for e -
CVE-2026-82355
Apache Airflow: Session cookie silently overrides explicit A
Same weakness: CWE-653
-
CVE-2026-57135
PraisonAI SandboxExecutor network-isolated mode does not blo -
CVE-2026-15366
Vivo Kids Mode 权限许可和访问控制问题漏洞 -
CVE-2026-71325
Traefik: `allowCrossNamespace=false` bypass via `@kubernetes -
CVE-2026-65635
Boruta dynamic client registration allows creation of over-p -
CVE-2026-53421
Apache Syncope: Remote Code Execution via Scripted Connector
V. Comments for CVE-2026-53405
No comments yet