VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Sep 14, 2026· Updated Sep 14, 2026

CVE-2026-77147

CVE-2026-77147

Description

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Syncope.

An administrator with adequate entitlements for Implementations can create a malicious Groovy Command class containing untrusted code in their CommandArgs static implementation, bypassing the Groovy security sandbox.

This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2.

Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

Affected products

2
  • Apache/Syncopeinferred2 versions
    >=4.1.0-M0,<4.1.3+ 1 more
    • (no CPE)range: >=4.1.0-M0,<4.1.3
    • (no CPE)range: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.