Cyber ·
CVE-2026-109083: remote code execution in Apache Syncope via Flowable JUEL expression
Moderate-severity advisory published on November 2, 2026 in the oss-sec feed: an administrator with adequate permissions can import BPMN process definitions containing a JUEL expression in Apache Syncope through the REST API and start the process, leading to remote code execution.
Advisory CVE-2026-109083 describes inadequate isolation or compartmentalization in Apache Syncope. According to the available text, an administrator with adequate permissions can import arbitrary BPMN process definitions through the REST API and then start the process. When the process contains a JUEL expression, sourced from the Flowable engine, the expression can be evaluated, resulting in remote code execution. The reported severity is moderate. The listed affected versions are Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, and 4.1.0 through 4.1.3. The content was published in the oss-sec feed by Francesco Chicchiriccò on November 2, 2026 and is an automatic translation; the excerpt available is truncated and does not state the fixed version. For organizations, the relevance lies in privilege control: whoever can import processes through the API should be treated as a potential code execution vector. Rota Nacional does not present this flaw as its own feature and does not claim to solve it. To verify, consult the original advisory in the oss-sec feed and the official Apache Syncope project documentation, confirm the installed version, and check the fixed version stated by the maintainers.