This vulnerability in Apache Syncope arises from improper isolation of Groovy scriptTasks within imported BPMN process definitions. Administrators can import and start BPMN processes containing Groovy scripts that execute directly on the server without sandboxing, leading to potential arbitrary code execution. The vulnerability affects Apache Syncope versions from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1. The issue is addressed in versions 4.0.7 and 4.1.2 by wrapping Flowable's Groovy scriptTasks with a security sandbox to prevent untrusted code execution.

Successful exploitation allows an administrator with adequate entitlements to execute arbitrary Groovy scripts on the server hosting Apache Syncope, potentially leading to full system compromise, data confidentiality, integrity, and availability loss. The vulnerability is critical due to the high impact on confidentiality, integrity, and availability, and the low attack complexity with network attack vector and no user interaction required.

Upgrade Apache Syncope to version 4.0.7 or 4.1.2 or later, where this vulnerability is fixed by sandboxing Groovy scriptTasks. No other mitigations are specified. Patch status is confirmed by the vendor advisory recommending these versions.