An authenticated Apache Syncope administrator with sufficient entitlements to import BPMN process definitions through the REST API can exploit it. The attacker must also be able to start the imported process.
Yes. The imported BPMN process definition must contain a JUEL expression, and the process must be started. Syncope executes that expression directly on the server without a sandbox.
The issue is fixed in Apache Syncope 4.0.9 and 4.1.4. These versions reject BPMN definitions that include expression attributes.
Restrict administrator entitlements that allow BPMN process definitions to be imported through the REST API and prevent untrusted administrators from starting imported processes. The provided information does not identify another technical mitigation.