CVE-2026-109083

The record

Improper isolation or compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a JUEL expression is imported and started, the expression is executed directly on the server, with no sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0 through 4.1.3. Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue by rejecting BPMN definitions including expression attributes.

Affected packages

Related vulnerabilities

• CVE-2026-113687 Improper isolation or compartmentalization vulnerability in Apache Syncope. CWE-653
• CVE-2026-120306 Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line… CWE-653
• CVE-2026-119408 n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code… CWE-653
• CVE-2026-115517 Unrestricted network access between execution contexts in KNIME Business Hub before… CWE-653
• CVE-2026-115416 Incorrect authorization checks in Amazon Athena engine version 3 query processing could… CWE-653
• CVE-2026-15366 A control logic defect in a specific built-in webpage of Kids Mode allows users to view… CWE-653
• CVE-2026-62246 Kamaji is the Hosted Control Plane Manager for Kubernetes. CWE-653
• CVE-2026-65635 Improper Isolation or Compartmentalization vulnerability in malach-it boruta… CWE-653