ervik.as
Back to CVE database

CVE-2026-73195

high · CVSS 7.3Published 9/14/2026 at 02:17 PMCWE-116

Improper Encoding or Escaping of Output vulnerability in Apache Syncope. Authenticated users can store a spreadsheet formula payload in o…

Improper Encoding or Escaping of Output vulnerability in Apache Syncope. Authenticated users can store a spreadsheet formula payload in one of their own plain attributes. When such users are included in a CSV export and the generated CSV file is opened by a spreadsheet application, the formula may be executed. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

Why it matters

Internet-facing
Not identified as a common internet-facing category
Exploitation likelihood
medium
  • Remotely exploitable over the network — no physical or local access required
  • Low attack complexity — no special conditions needed to exploit
  • Requires low-privilege access first
  • Requires the victim to take an action (e.g. open a file or link)
Recommended mitigation

Apply the vendor patch as soon as it's available or already released. Review and restrict accounts with the privilege level this vulnerability requires. User-awareness training reduces risk here, since exploitation depends on tricking a user into acting.

This analysis is generated from structured CVSS vector data, CISA KEV cross-referencing, and vendor/product category rules — not a manual expert review. Treat it as a starting point, not a substitute for your own assessment.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Attack Vector
Network
Complexity
Low
Privileges Req.
Low
User Interaction
Required

EU Vulnerability Database (ENISA)

EUVD ID
EUVD-2026-77475
View on EUVD

EUVD is ENISA's EU vulnerability database, still in beta. EPSS is a probabilistic exploitation-likelihood score, not a certainty.

View official CVE record

Stay Updated

New CVEs and vulnerability advisories are added continuously as they're disclosed. Subscribe via RSS to get every update the moment it's published — no email or account required.

Subscribe via RSS
Share Share
Advertisement