Apache Syncope versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, and 4.1.0 through 4.1.3 contain an improper isolation vulnerability. An administrator with sufficient entitlements can import BPMN process definitions via the REST API and start them. If the BPMN process includes a JUEL expression, it is executed directly on the server without sandboxing, potentially leading to unsafe execution of expressions. Versions 4.0.9 and 4.1.4 address this issue by rejecting BPMN definitions that include expression attributes.