Cyber ·
CVE-2026-113687: remote code execution in Apache Syncope via Groovy sandbox bypass
Advisory dated November 2, 2026 on a high-severity flaw in Apache Syncope: an administrator with suitable permissions can run untrusted code outside the Groovy sandbox.
According to the public text relayed by the oss-sec feed on November 2, 2026, vulnerability CVE-2026-113687 affects Apache Syncope and is rated as important severity. The affected versions are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, and 4.1.0-M0 through 4.1.3. According to the description, an administrator with suitable permissions for Implementations can create a malicious Groovy class that runs untrusted code in a separate thread, bypassing the Groovy security sandbox. The text received is truncated, so remediation and mitigation guidance should be checked at the official source. The case shows that a sandbox does not replace limits on who can register code and separation of administrative privileges. To verify, consult the original advisory referenced in the oss-sec feed, confirm whether your installation uses any listed version, and follow the Apache project announcement about the fixed release.