CVE-2026-42782 is an improper isolation or compartmentalization vulnerability (CWE-653) in Apache Syncope. It allows an administrator with implementation privileges to create a malicious Groovy class containing untrusted code that executes via the class static initializer outside the sandbox. This vulnerability affects Apache Syncope versions 3.0 through 3.0.16, 4.0 through 4.0.5, and 4.1.0. The issue is resolved in versions 4.0.6 and 4.1.1 by enforcing sandboxing on the static initializer execution path.

Successful exploitation allows an administrator with adequate entitlements to execute arbitrary untrusted Groovy code outside the sandbox, potentially compromising confidentiality, integrity, and availability of the system. The CVSS 3.1 base score is 7.2 (high), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Users should upgrade Apache Syncope to version 4.0.6 or 4.1.1, where this vulnerability is fixed by sandboxing the Groovy static initializer. No other mitigation or workaround is indicated. Patch status is confirmed by vendor advisory recommending these versions.