The vulnerability is an improper isolation flaw that allows an administrator with adequate entitlements to create a malicious Groovy class that runs untrusted code on a separate thread, thereby bypassing the Groovy security sandbox and enabling remote code execution.

Affected versions of Apache Syncope include all releases from 3.0.0‑M0 to 3.0.16, from 4.0.0‑M0 to 4.0.8, and from 4.1.0‑M0 to 4.1.3. The flaw exists in the ProcessGroovyMethodsSandbox component of these versions.

The CVSS score is not listed, and the EPSS score is unavailable, but the vulnerability is not in the KEV catalog, indicating it is not a known exploited vulnerability. Exploit requires administrative credentials with the ability to implement custom Groovy classes, making the attack vector authenticated and privilege‑escalation‑like. Once the malicious code runs on a separate thread, it can execute arbitrary actions with the privileges of the Syncope daemon, potentially compromising confidentiality, integrity, and availability of the underlying system.