CVE-2026-53405

Katalog CVE

CVSS 9.8 · Critical EPSS 0,75%

Kerentanan Improper Isolation or Compartmentalization pada apache syncope. Skor CVSS 3.1 9.8 (Critical) menurut CISA ADP.

Deskripsi (NVD)

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a Groovy scriptTask is imported and started, the Groovy script is executed directly on the server, with no sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue by wrapping Flowable's Groovy scriptTasks with security sandbox.

Rincian

Terbit di NVD

20 Juli 2026

Terakhir diubah

27 Juli 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-653: Improper Isolation or Compartmentalization

EPSS (30 hari)

0,75% peluang dieksploitasi; lebih tinggi dari 53,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/vdq0tk6ylffz6trbgbllj9kb1ndzff7k mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2026/07/20/6 mailing list · advisory pihak ketiga