CVE-2026-109083

CriticalCVSS 9.8/10Last modified Nov 6, 2026

Description

Improper isolation or compartmentalization vulnerability in Apache Syncope.

An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a JUEL expression is imported and started, the expression is executed directly on the server, with no sandbox.

This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0 through 4.1.3.

Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue by rejecting BPMN definitions including expression attributes.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-653

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Syncope	>= 3.0.0-M0, <= 3.0.16; >= 4.0.0-M0, <= 4.0.8; >= 4.1.0, <= 4.1.3

References

Timeline

Published: Nov 2, 2026
Last modified: Nov 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1090886.5A malicious X server could send malformed RECORD EnableContext reolies that can cause a X client using the parse_reply_call_callback functi CVE-2026-1090897.5A buffer overflow when handling DEVICE_RESOLUTION in libXi before 1.8.4 could overflow a heap, triggered by a malicious X server.CVE-2026-109098.3Use after free in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potenti CVE-2026-1090907.5A malicious X server could cause a heap overflow by injecting a large DEVICE_ENABLE reply when processed by libXi before 1.8.4.CVE-2026-1090978.2A vulnerability has been identified in ROS# (All versions < V2.3.1). Affected systems do not properly escape text of message definition file CVE-2026-109108.8Type Confusion in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a craf CVE-2026-1091064.4A security flaw has been discovered in Polaris Office App 9.9.19 on Android. Affected by this vulnerability is the function com.infraware.se CVE-2026-1091076.5A weakness has been identified in Wavlink WL-WN592AX6 250422. Affected by this issue is the function main of the file /cgi-bin/upload.cgi. T CVE-2026-1091089.9A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. This affects the function popen of the file /cgi-bin/uploadVpn.c CVE-2026-10910910.0A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllS CVE-2026-109118.3Insufficient validation of untrusted input in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised th CVE-2026-10911010.0A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manip