CVE-2026-77147
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy Command class containing untrusted code in their CommandArgs static implementation, bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
- EPSS probability
- 0.28%
- CWE
- CWE-94
- Published
- 2026-09-14
- Last modified
- 2026-09-14
Affected products
- Apache Software Foundation Apache Syncope
- Apache Software Foundation Apache Syncope
- Apache Software Foundation Apache Syncope
Weakness type
Related vulnerabilities
- CVE-2026-60004 — Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
- CVE-2026-76605 — Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.2
- CVE-2026-76604 — Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.2
- CVE-2026-92937 — vm2 3.11.6 Remote Code Execution via Promise call/apply
- CVE-2026-85978 — Unauthenticated Remote Code Execution in Akana API Platform
- CVE-2026-62104 — WordPress Migratico Lite plugin <= 2.6.8 - Remote Code Execution (RCE) vulnerability
- CVE-2026-53710 — MCP Context Forge: RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server
- CVE-2026-55565 — Yamcs: Authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`)