CVE-2025-66027
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.6, an information disclosure vulnerability exposes participant details, including names and email addresses through the /api/trpc/polls.get,polls.participants.list endpoint, even when Pro privacy features are enabled. This bypasses intended privacy controls that should prevent participants from viewing other users' personal information. This issue has been patched in version 4.5.6.
Risk Assessment
The risk involves a breach of participant privacy, as their personal data may be visible to other participants, potentially leading to unauthorized use of information or violation of data protection regulations.
Recommendation
Immediately update Rallly to version 4.5.6 or later, which includes the fix. Also review privacy configuration and ensure Pro features are properly implemented.
Other vulnerabilities in Rallly
See all- CVE-2025-65021Critical
Rallly prior to version 4.5.4 has an IDOR vulnerability in the poll finalization feature. Any authenticated user can finalize a poll they do not own by manipulating the pollId parameter, allowing unauthorized finalization and conversion to events.
- CVE-2026-92565Medium
An information disclosure vulnerability in Rallly before 4.15.0 in the polls.get tRPC procedure returns scheduled-event invitee names and email addresses to unauthenticated callers. Attackers can access a poll's urlId from public invite links to retrieve sensitive invitee information regardless of privacy settings.
Original NVD description (English source)
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.6, an information disclosure vulnerability exposes participant details, including names and email addresses through the /api/trpc/polls.get,polls.participants.list endpoint, even when Pro privacy features are enabled. This bypasses intended privacy controls that should prevent participants from viewing other users’ personal information. This issue has been patched in version 4.5.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS