CVE-2026-73195: Apache Syncope: CSV export spreadsheet formula injection

Apache Syncope, an open-source identity management platform, fails to properly encode or escape output when generating CSV exports, allowing an authenticated user to plant a spreadsheet formula (typically a payload beginning with characters like '=', '+', '-', or '@') in one of their own plain user attributes. When an administrator or analyst exports users to CSV and opens the file in a spreadsheet application such as Excel or LibreOffice, the embedded formula may execute, which can lead to sensitive data exfiltration or further malicious actions depending on the spreadsheet application's security settings. The issue affects Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2, and is fixed in 4.0.8 and 4.1.3. There is no public proof of concept and no known exploitation in the wild, but the vulnerability requires only an authenticated account and a victim opening an exported file, giving it a CVSS 3.1 score of 7.3 (high).

Do: Upgrade to Apache Syncope 4.0.8 or 4.1.3; users on the 3.0.x branch have no listed fix and should plan a migration to a patched 4.x release. Until patched, treat CSV exports as untrusted: open them in a text editor or import tool that does not evaluate formulas, ensure spreadsheet applications warn about or block formulas, and audit user plain attributes for payloads starting with '=', '+', '-', or '@'.