CVE-2026-63071

The record

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue by tightening the Groovy security sandbox.

Affected packages

Related vulnerabilities

• CVE-2026-119408 n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code… CWE-653
• CVE-2026-115517 Unrestricted network access between execution contexts in KNIME Business Hub before… CWE-653
• CVE-2026-15366 A control logic defect in a specific built-in webpage of Kids Mode allows users to view… CWE-653
• CVE-2026-62246 Kamaji is the Hosted Control Plane Manager for Kubernetes. CWE-653
• CVE-2026-65635 Improper Isolation or Compartmentalization vulnerability in malach-it boruta… CWE-653
• CVE-2026-53421 Improper Isolation or Compartmentalization vulnerability in Apache Syncope. CWE-653
• CVE-2026-53405 Improper Isolation or Compartmentalization vulnerability in Apache Syncope. CWE-653
• CVE-2026-15738 Incorrect behavior order in the Gateway API listener-rule generation in Amazon AWS Load… CWE-653