CVE-2025-57738

Apache Syncope allows administrators to extend the product with custom Java or Groovy implementations of internal interfaces, but the Groovy path lacked proper isolation, letting injected code run outside a sandbox. A malicious or compromised Syncope administrator can inject Groovy code that is executed remotely by a running Syncope Core instance on the deployment's server. Because the code executes with the privileges of the Syncope Core process, an attacker with administrator access can escalate to arbitrary code execution on the underlying host, with high impact to confidentiality, integrity, and availability (CVSS 7.2). Deployments running the 3.0.x line before 3.0.14 or the 4.0.x line before 4.0.2 are affected. No public proof-of-concept or confirmed in-the-wild exploitation is known, though EPSS assigns a 23.1% probability of exploitation within 30 days.

What to do: Upgrade to Apache Syncope 3.0.14 (3.0.x) or 4.0.2 (4.0.x), which force Groovy code to run in a sandbox. Until patched, restrict and audit administrator access and review any custom Groovy implementations configured in your deployment, since they are the injection path. Verify your running Syncope version and branch, as only the 3.0.x and 4.0.x lines receive these fixed releases.