CVE-2026-113687

The record

Improper isolation or compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class running untrusted code on a separate Thread, thus bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3. Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.

Affected packages

Related vulnerabilities

• CVE-2026-109083 Improper isolation or compartmentalization vulnerability in Apache Syncope. CWE-653
• CVE-2026-120306 Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line… CWE-653
• CVE-2026-119408 n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code… CWE-653
• CVE-2026-115517 Unrestricted network access between execution contexts in KNIME Business Hub before… CWE-653
• CVE-2026-115416 Incorrect authorization checks in Amazon Athena engine version 3 query processing could… CWE-653
• CVE-2026-15366 A control logic defect in a specific built-in webpage of Kids Mode allows users to view… CWE-653
• CVE-2026-62246 Kamaji is the Hosted Control Plane Manager for Kubernetes. CWE-653
• CVE-2026-65635 Improper Isolation or Compartmentalization vulnerability in malach-it boruta… CWE-653