CVE WATCH / VULNERABILITY DETAIL
CVE-2026-109083
UNKNOWNCVSS 0NVD feed
Published 2 November 2026 · tracked since 2 November 2026
Description
Improper isolation or compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a JUEL expression is imported and started, the expression
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog