CVE-2026-109083
Description
Improper isolation or compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a JUEL expression is imported and started, the expression is executed directly on the server, with no sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0 through 4.1.3. Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue by rejecting BPMN definitions including expression attributes.
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Software Foundation Apache Syncope | 3.0.0-M0 ≤ v ≤ 3.0.16, 4.0.0-M0 ≤ v ≤ 4.0.8, 4.1.0 ≤ v ≤ 4.1.3 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.