CVE-2026-92565
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
An information disclosure vulnerability in Rallly before 4.15.0 in the polls.get tRPC procedure returns scheduled-event invitee names and email addresses to unauthenticated callers. Attackers can access a poll's urlId from public invite links to retrieve sensitive invitee information regardless of privacy settings.
Risk Assessment
The risk is the exposure of personal data of event participants, which could lead to privacy violations, phishing, or other social engineering attacks.
Recommendation
Upgrade Rallly to version 4.15.0 or later, and review poll privacy settings to prevent unauthorized access to invitee data.
Other vulnerabilities in Rallly
Original NVD description (English source)
Rallly before 4.15.0 contains an information disclosure vulnerability in the polls.get tRPC procedure that returns scheduled-event invitee names and email addresses to unauthenticated callers. Attackers can access a poll's urlId from public invite links to retrieve sensitive invitee information regardless of privacy settings.