CVE-2026-63071 describes a CWE-653 improper isolation or compartmentalization vulnerability in Apache Syncope. An administrator with sufficient privileges to manage Implementations can create a malicious Groovy class containing untrusted code that bypasses the Groovy security sandbox protections. This allows potentially harmful code execution within the system. The vulnerability affects Apache Syncope versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1. The vendor addressed the issue by tightening the Groovy sandbox in versions 4.0.7 and 4.1.2.

Successful exploitation allows an administrator with Implementation entitlements to execute untrusted code beyond intended sandbox restrictions, potentially leading to full system compromise including confidentiality, integrity, and availability impacts. The CVSS score of 9.8 reflects critical severity with network attack vector, low attack complexity, no privileges required beyond the specified role, and no user interaction needed.

Users should upgrade Apache Syncope to versions 4.0.7 or 4.1.2 or later, where the Groovy security sandbox has been tightened to prevent bypass. No other official remediation or temporary fixes are indicated. Patch status is confirmed by the vendor's version recommendations.