CVE-2026-42782: Apache Syncope has an Improper Isolation or Compartmentalization vulnerability

May 26, 2026 (updated June 30, 2026)

Improper Isolation or Compartmentalization vulnerability in Apache Syncope.

An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code reaching a non-sandboxed execution path via the class static initializer.

This issue affects Apache Syncope: 3.0 through 3.0.16, 4.0 through 4.0.5, 4.1.0.

Users are recommended to upgrade to version 4.0.6 / 4.1.1, which fix this issue by forcing even the static initializer in Groovy code to run in a sandbox.

References

github.com/advisories/GHSA-gq7g-vg2q-jvq3
lists.apache.org/thread/b869ms0ofrd129f7tgsn9flxgv9ztg2r
nvd.nist.gov/vuln/detail/CVE-2026-42782

Code Behaviors & Features

Detect and mitigate CVE-2026-42782 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →