CVE-2026-113687: Apache Software Foundation Apache Syncope, логическа

Описание

Оригинално описание

Improper isolation or compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class running untrusted code on a separate Thread, thus bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3. Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.

Засегнати продукти

• Apache Software Foundation Apache Syncope: 3.0.0-M0 до 3.0.16; 4.0.0-M0 до 4.0.8; 4.1.0-M0 до 4.1.3

Вид слабост

• CWE-653 Improper Isolation or Compartmentalization

История

Други уязвимости в Apache Software Foundation Apache Syncope

• CVE-2026-114364
• CVE-2026-113511
• CVE-2026-110535
• CVE-2026-109083
• 6.1CVE-2026-73191

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-113687
• https://nvd.nist.gov/vuln/detail/CVE-2026-113687
• https://lists.apache.org/thread.html/xxfmworgxt6bf1got05b5pqbb679zjp0
• http://www.openwall.com/lists/oss-security/2026/11/02/10