Apache Syncope Groovy Flaw Allows Remote Code Injection

Apache Syncope has disclosed a critical vulnerability, tracked as CVE-2025-57738, that allows authenticated administrators to execute arbitrary code on affected systems through Groovy code. The flaw affects all Apache Syncope versions 3.x before 3.0.14 and 4.x before 4.0.2, exposing organisations to potential system compromise via malicious Groovy code injection.

Exploitation relies on administrators or delegated admins within a Syncope tenant who have entitlements to create or update Groovy implementations and trigger their execution through reports or engine hooks. The vulnerability exists because vulnerable versions run unpatched Groovy code with full privileges, and the attack can lead to command execution, filesystem modification, data exfiltration, and lateral movement depending on network segmentation and container security.

Apache has released patched versions 3.0.14 and 4.0.2 that introduce a Groovy sandbox to block dangerous operations, and organisations are advised to upgrade and audit HTTP POSTs to /syncope/rest/implementations and PUTs to implementation update endpoints referencing the GROOVY engine, as well as suspicious report creation and execution activities.