CVE-2026-53405CWE-653

Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask

Critical · published July 20, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
54.3
In the wild
Unconfirmed
What it is

Improper Isolation or Compartmentalization vulnerability in Apache Syncope.

An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a Groovy scriptTask is imported and started, the Groovy script is executed directly on the server, with no sandbox.

This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1.

Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue by wrapping Flowable's Groovy scriptTasks with security sandbox.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00746 · 54.3th percentile
Weakness
CWE-653 · Improper Isolation or Compartmentalization
Published
2026-07-20T14:20Z
EPSS history
Timeline
  • 20 JUL 14:20Z
    Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask
    cvelistv5