CVE-2026-73195: Apache Syncope: CSV export spreadsheet formula injection
Apache Syncope CVE-2026-73195 allows authenticated users to inject spreadsheet formulas into CSV exports.
Apache Syncope disclosed CVE-2026-73195, a moderate-rated improper encoding or escaping of output vulnerability. Authenticated users can inject spreadsheet formulas into data that is later exported as CSV, which may execute when an administrator opens the file in a spreadsheet application. The flaw affects syncope-core-provisioning-java in versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.
- CSV formula injection (CSV injection) in Syncope data exports
- Requires an authenticated attacker and victim opening export in spreadsheet app
- Affects Syncope 3.0.x, 4.0.x, and 4.1.x release lines
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-73195 | CSV Formula Injection in Apache Syncope User Attribute Exports | 7.3 | — |
From the original article
Posted by Francesco Chicchiriccò on Sep 14 Severity: moderate Affected versions: - Apache Syncope (org. apache. syncope.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.