Ce mail provient de l'extérieur, restons vigilants ===================================================================== CERT-Renater Note d'Information No. 2026/VULN773 _____________________________________________________________________ DATE : 20/07/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running Apache Syncope versions prior to 4.0.7, 4.1.2. ===================================================================== https://lists.apache.org/thread/85xt6oh93wj3j4n3ypq4c0bbf1zovs26 https://lists.apache.org/thread/nmzvz6gb2ldm30wvyk613r8dfrb6r8yx https://lists.apache.org/thread/g0gpctj90pbczbjl5jr33t8gr1gltg8v https://lists.apache.org/thread/6r8cngvy43y2yk4jj3w060dt8vx0yzpr https://lists.apache.org/thread/n632drbsmfr6t3p6jt6jwbjvokqdyszb https://lists.apache.org/thread/2236mlm6hbvs6g16yqz5y9s8bb7q1lo1 _____________________________________________________________________ CVE-2026-53405: Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask Severity: moderate Affected versions: - Apache Syncope (org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn) 3.0.0-M0 through 3.0.16 - Apache Syncope (org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn) 4.0.0-M0 through 4.0.6 - Apache Syncope (org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn) 4.1.0-M0 through 4.1.1 Description: Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a Groovy scriptTask is imported and started, the Groovy script is executed directly on the server, with no sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue by wrapping Flowable's Groovy scriptTasks with security sandbox. Credit: follycat, Y0n3er (finder) References: https://syncope.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-53405 _____________________________________________________________________ CVE-2026-53421: Apache Syncope: Remote Code Execution via Scripted Connector Severity: moderate Affected versions: - Apache Syncope 3.0.0-M0 through 3.0.16 - Apache Syncope 4.0.0-M0 through 4.0.6 - Apache Syncope 4.1.0-M0 through 4.1.1 Description: Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve remote code execution through the connector subsystem by relying on scripted connectors' (REST and SQL) capability to run Groovy scripts. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue by hardening the Groovy security sandbox. Credit: follycat, Y0n3er (finder) References: https://syncope.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-53421 _____________________________________________________________________ CVE-2026-57308: Apache Syncope: SQL injection vulnerability in Audit Events search Severity: important Affected versions: - Apache Syncope 3.0.0-M0 through 3.0.16 - Apache Syncope 4.0.0-M0 through 4.0.6 - Apache Syncope 4.1.0-M0 through 4.1.1 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort parameters. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue. Credit: Lennart Hostettler (finder) References: https://syncope.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-57308 _____________________________________________________________________ CVE-2026-62183: Apache Syncope: User self-service privilege escalation Severity: important Affected versions: - Apache Syncope (org.apache.syncope.core:syncope-core-workflow-java) 3.0.0-M0 through 3.0.16 - Apache Syncope (org.apache.syncope.core:syncope-core-workflow-java) 4.0.0-M0 through 4.0.6 - Apache Syncope (org.apache.syncope.core:syncope-core-workflow-java) 4.1.0-M0 through 4.1.1 Description: Improper Privilege Management vulnerability in Apache Syncope. When: * the all-Java user workflow adapter is configured, or * the Flowable user workflow adapter is configured, bearing a BPMN definition not requiring admin approval for user self registration of self update requests the following scenario could happen. A REST API call can allow the user to grant themselves one or more of defined Roles, thus gaining their Entitlements and becoming in fact an administrator; the actual Entitlements gained depend on the Roles that are effectively defined on the specific Syncope deployment. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue. Credit: Nic Jones (finder) elin kai (finder) References: https://syncope.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-62183 _____________________________________________________________________ CVE-2026-62418: Apache Syncope: Low-privileged authenticated SSRF in Connectors and Resources check Severity: moderate Affected versions: - Apache Syncope (org.apache.syncope.core.idm:syncope-core-idm-logic) 3.0.0-M0 through 3.0.16 - Apache Syncope (org.apache.syncope.core.idm:syncope-core-idm-logic) 4.0.0-M0 through 4.0.6 - Apache Syncope (org.apache.syncope.core.idm:syncope-core-idm-logic) 4.1.0-M0 through 4.1.1 Description: Low-privileged authenticated Server-Side Request Forgery (SSRF) vulnerability in Apache Syncope via Connectors and Resources check. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue. Credit: Adrián Leal Castaño (finder) References: https://syncope.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-62418 _____________________________________________________________________ CVE-2026-63071: Apache Syncope: RCE via Groovy Sandbox bypass Severity: moderate Affected versions: - Apache Syncope (org.apache.syncope.core:syncope-core-spring) 3.0.0-M0 through 3.0.16 - Apache Syncope (org.apache.syncope.core:syncope-core-spring) 4.0.0-M0 through 4.0.6 - Apache Syncope (org.apache.syncope.core:syncope-core-spring) 4.1.0-M0 through 4.1.1 Description: Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue by tightening the Groovy security sandbox. Credit: elin kai (finder) 无聊 (finder) References: https://syncope.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-63071 ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================