CVE-2026-63071 is an improper isolation or compartmentalization vulnerability in Apache Syncope. It allows an administrator with appropriate entitlements for Implementations to create a malicious Groovy class containing untrusted code that bypasses the Groovy security sandbox protections. This vulnerability affects Apache Syncope versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1. The vulnerability is addressed in versions 4.0.7 and 4.1.2 by enhancing the Groovy sandbox security controls to prevent such bypasses.

Successful exploitation allows an administrator to execute untrusted code by bypassing the Groovy sandbox, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability, classifying this vulnerability as critical.

Users should upgrade Apache Syncope to versions 4.0.7 or 4.1.2, where the vulnerability is fixed by tightening the Groovy security sandbox. No other mitigations are specified. Patch status is confirmed by the vendor advisory recommending these versions.