CVE-2026-53405 describes an improper isolation or compartmentalization vulnerability (CWE-653) in Apache Syncope. Administrators with appropriate entitlements can import arbitrary BPMN process definitions containing Groovy scriptTasks via the REST API and start them. The Groovy scripts execute directly on the server without sandboxing, which can lead to execution of potentially unsafe code. The vulnerability affects Apache Syncope versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1. The vendor fixed this issue in versions 4.0.7 and 4.1.2 by wrapping Flowable's Groovy scriptTasks with a security sandbox to prevent unsafe script execution.

An administrator with sufficient privileges can execute arbitrary Groovy scripts on the server by importing and starting malicious BPMN processes. This could lead to unauthorized code execution within the server context, potentially compromising the system or data. The impact is limited to administrators who can access the REST API to import and start BPMN processes.

Users should upgrade Apache Syncope to versions 4.0.7 or 4.1.2 or later, where the vulnerability is fixed by sandboxing Groovy scriptTasks. No other mitigation or temporary workaround is indicated. Patch status is confirmed by the vendor advisory recommending these versions.