CVE-2026-53421

The record

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve remote code execution through the connector subsystem by relying on scripted connectors' (REST and SQL) capability to run Groovy scripts. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue by hardening the Groovy security sandbox.

Affected packages

Related vulnerabilities

• CVE-2026-119408 n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code… CWE-653
• CVE-2026-115517 Unrestricted network access between execution contexts in KNIME Business Hub before… CWE-653
• CVE-2026-15366 A control logic defect in a specific built-in webpage of Kids Mode allows users to view… CWE-653
• CVE-2026-62246 Kamaji is the Hosted Control Plane Manager for Kubernetes. CWE-653
• CVE-2026-65635 Improper Isolation or Compartmentalization vulnerability in malach-it boruta… CWE-653
• CVE-2026-63071 Improper Isolation or Compartmentalization vulnerability in Apache Syncope. CWE-653
• CVE-2026-53405 Improper Isolation or Compartmentalization vulnerability in Apache Syncope. CWE-653
• CVE-2026-15738 Incorrect behavior order in the Gateway API listener-rule generation in Amazon AWS Load… CWE-653