CVE-2026-109083
CRITICAL
INFO
Priority: 0.05
BB Relevance:
80/100
Published: 2026-11-02
Modified: 2026-11-06
First seen: 2026-11-02
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
S:
Unchanged
C:
High
I:
High
A:
High
Description
Improper isolation or compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a JUEL expression is imported and started, the expression is executed directly on the server, with no sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0 through 4.1.3. Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue by rejecting BPMN definitions including expression attributes.
Weakness Classification (1)
Affected Software (9)
| Vendor | Product | Version |
|---|---|---|
| Apache Software Foundation | Apache Syncope | 3.0.0-M0 |
| Apache Software Foundation | Apache Syncope | 4.0.0-M0 |
| Apache Software Foundation | Apache Syncope | 4.1.0 |
| Apache Software Foundation | Apache Syncope | 3.0.0-M0 |
| Apache Software Foundation | Apache Syncope | 4.0.0-M0 |
| Apache Software Foundation | Apache Syncope | 4.1.0 |
| Apache Software Foundation | Apache Syncope | 3.0.0-M0 |
| Apache Software Foundation | Apache Syncope | 4.0.0-M0 |
| Apache Software Foundation | Apache Syncope | 4.1.0 |
References & Advisories (2)
vendor-advisory