CVE-2026-53405

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-53405
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53405.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-53405
Published
2026-07-20T14:20:06.824Z
Modified
2026-08-12T03:51:18.108713759Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask
Details

Improper Isolation or Compartmentalization vulnerability in Apache Syncope.

An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a Groovy scriptTask is imported and started, the Groovy script is executed directly on the server, with no sandbox.

This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1.

Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue by wrapping Flowable's Groovy scriptTasks with security sandbox.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53405.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "3.0.0-M0"
                },
                {
                    "last_affected": "3.0.16"
                },
                {
                    "introduced": "4.0.0-M0"
                },
                {
                    "last_affected": "4.0.6"
                },
                {
                    "introduced": "4.1.0-M0"
                },
                {
                    "last_affected": "4.1.1"
                }
            ]
        },
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "introduced": "3.0.0-M0"
                },
                {
                    "fixed": "3.0.16"
                },
                {
                    "introduced": "4.0.0-M0"
                },
                {
                    "fixed": "4.0.6"
                },
                {
                    "introduced": "4.1.0-M0"
                },
                {
                    "fixed": "4.1.1"
                }
            ]
        }
    ],
    "cwe_ids": [
        "CWE-653"
    ],
    "cna_assigner": "apache"
}
References

Affected packages

Git / github.com/apache/syncope

Affected ranges

Type
GIT
Repo
https://github.com/apache/syncope
Events
Introduced
d4a8b1eb53b246c42acb757739637be02838a082
Last affected
2b741bd0d6b4f49779a0c01cad597c6a15f93351
Introduced
b0c019c1256bf433bf60e3211ee8711dae03e6bc
Fixed
84abc48d024599ca49ef07b726e698206120ffd9
Introduced
7afe57a317c88ebedf75ca8d714ad743e5cd1d24
Fixed
1607ab1fff8542e6fdd634ff68b9afd03d80dd8c
Database specific
Show details 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:apache:syncope:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "3.0.0"
        },
        {
            "last_affected": "3.0.16"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.0.7"
        },
        {
            "introduced": "4.1.0"
        },
        {
            "fixed": "4.1.2"
        }
    ]
}

Affected versions

syncope-3.*
syncope-3.0.0
syncope-3.0.1
syncope-3.0.10
syncope-3.0.11
syncope-3.0.12
syncope-3.0.13
syncope-3.0.14
syncope-3.0.15
syncope-3.0.16
syncope-3.0.2
syncope-3.0.3
syncope-3.0.4
syncope-3.0.5
syncope-3.0.6
syncope-3.0.7
syncope-3.0.8
syncope-3.0.9
syncope-4.*
syncope-4.0.0
syncope-4.0.1
syncope-4.0.2
syncope-4.0.3
syncope-4.0.4
syncope-4.0.5
syncope-4.0.6
syncope-4.1.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53405.json"