OpenPanel CVE-2026-108579

Exploitation requires an attacker to POST tracking events to the /track endpoint (reachable without authentication, PR:N) using a profile ID containing a spreadsheet formula such as =HYPERLINK(...) that is crafted to match an existing cohort's membership criteria (the AT:P attack requirement). Realized impact further depends on a privileged OpenPanel operator subsequently exporting that cohort's members to CSV and opening the file in a spreadsheet application that evaluates formulas and permits the resulting external data fetch / hyperlink action (the UI:P passive interaction). These prerequisites - a matching cohort, an operator-initiated export, and a victim opening the file in a formula-executing client - are the primary factors limiting real-world exploitation despite the unauthenticated network entry point.

All signals point to a LOW real-world priority. The input CVSS 4.0 base score is 2.3 (Low), and the vector itself explains why: although AV:N and PR:N indicate a network-reachable, unauthenticated injection point (the /track endpoint), two strong limiters are present - AT:P (the crafted profile ID must match an existing cohort) and UI:P (a victim operator must passively export the cohort to CSV and open it in a spreadsheet). Impact is bounded to VC:L/VI:L with VA:N and no scope change (SC:N/SI:N/SA:N), consistent with CWE-1236 formula injection that leaks only adjacent cell data. No EPSS score was provided, so exploitation probability cannot be quantified from the input. This is NOT in CISA KEV and no public exploit code was identified, so this is 'no public exploit identified at time of analysis' - although two technical write-ups (VulnCheck advisory and a hackmd analysis) exist, raising awareness without providing weaponized tooling. No SSVC decision data was supplied. Bottom line: this is a genuinely low-severity, operator-and-victim-dependent issue rather than a high-CVSS/low-real-risk mismatch - the low score is well justified by the multi-step, interaction-gated attack path.

An unauthenticated attacker sends tracking events to OpenPanel's /track endpoint using a profile ID crafted as a spreadsheet formula (e.g. =HYPERLINK(...)) designed to match a defined cohort. Later, when an OpenPanel operator exports that cohort's members to CSV and opens the file in a spreadsheet application, the embedded formula executes and exfiltrates adjacent cell data to an attacker-controlled destination. No public exploit code was identified, though technical write-ups describe the flaw in detail.