Improper Encoding or Escaping of Output vulnerability in Apache Syncope. (CVE-2026-73195)
Apache Syncope contains an improper encoding or escaping of output vulnerability (CVE-2026-73195) that allows authenticated users to store spreadsheet formula payloads in their own plain attributes. When these users are included in a CSV export, opening the CSV file in a spreadsheet application may execute the formula. This affects versions from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Upgrading to versions 4.0.8 or 4.1.3 mitigates the issue.
AI Analysis
Technical Summary
CVE-2026-73195 is an output encoding vulnerability in Apache Syncope that permits authenticated users to inject spreadsheet formula payloads into their own plain attributes. When these attributes are included in CSV exports, opening the CSV in spreadsheet software can trigger execution of the formula. This vulnerability affects multiple pre-release and stable versions of Apache Syncope, specifically 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. The issue is fixed in versions 4.0.8 and 4.1.3.
Potential Impact
An attacker with authenticated access can inject malicious spreadsheet formulas into their own attributes, which may be executed when a CSV export including these attributes is opened in a spreadsheet application. This can lead to high confidentiality and integrity impacts, such as data leakage or manipulation, but does not affect availability. The CVSS v3.1 score is 7.3 (high).
Mitigation Recommendations
Users should upgrade Apache Syncope to version 4.0.8 or 4.1.3, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated in the provided data.
Improper Encoding or Escaping of Output vulnerability in Apache Syncope. (CVE-2026-73195)
Description
Apache Syncope contains an improper encoding or escaping of output vulnerability (CVE-2026-73195) that allows authenticated users to store spreadsheet formula payloads in their own plain attributes. When these users are included in a CSV export, opening the CSV file in a spreadsheet application may execute the formula. This affects versions from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Upgrading to versions 4.0.8 or 4.1.3 mitigates the issue.
CVSS v3.1
Score 7.3high
Affected software
pkg:maven/org.apache.syncope/syncope-coreRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-73195 is an output encoding vulnerability in Apache Syncope that permits authenticated users to inject spreadsheet formula payloads into their own plain attributes. When these attributes are included in CSV exports, opening the CSV in spreadsheet software can trigger execution of the formula. This vulnerability affects multiple pre-release and stable versions of Apache Syncope, specifically 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. The issue is fixed in versions 4.0.8 and 4.1.3.
Potential Impact
An attacker with authenticated access can inject malicious spreadsheet formulas into their own attributes, which may be executed when a CSV export including these attributes is opened in a spreadsheet application. This can lead to high confidentiality and integrity impacts, such as data leakage or manipulation, but does not affect availability. The CVSS v3.1 score is 7.3 (high).
Mitigation Recommendations
Users should upgrade Apache Syncope to version 4.0.8 or 4.1.3, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated in the provided data.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-3gg5-c8gj-frxr
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-73195"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aa8a1d055bf5e2cf5f3e93d
Added to database: 09/15/2026, 01:39:28 UTC
Last enriched: 09/15/2026, 02:03:20 UTC
Last updated: 09/15/2026, 08:01:23 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.