Based on the description, it is inferred that the attacker must have sufficient entitlements as an administrator to create the malicious Groovy class. An administrator with sufficient entitlements in Apache Syncope can create a malicious Groovy class whose static initializer contains untrusted code. Because the static initializer runs without a sandbox, the code can execute arbitrary instructions on the system, giving the attacker full server control. The weakness is classified as Improper Isolation or Compartmentalization.

Apache Syncope versions 3.0 through 3.0.16, 4.0 through 4.0.5, and 4.1.0 are affected. The issue is fixed in the subsequent releases 4.0.6 and 4.1.1, which enforce sandboxed execution for all Groovy code, including static initializers.

Based on the description, it is inferred that the attack vector requires an authenticated user with implementation privileges. The vulnerability lacks a published CVSS score, but its nature—remote code execution under a privileged account—makes it a high‑risk issue. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. Once such a user can upload or modify Groovy scripts, execution of the malicious static initializer can compromise the entire Syncope deployment.