CVE-2026-125369: Bitpoll through 0.11.0 Unauthenticated Vote and Comment Disclosure via Unscoped Lookups
Bitpoll through 0.11.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read votes and comments from other polls via unscoped object lookups in views.py. Attackers can pair any public poll slug with sequential vote or comment IDs in vote, votedelete, voteassign, or deletecomment GET requests to read names and comments from restricted polls.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can exploit it. The attacker only needs a public poll slug and sequential vote or comment IDs.
What information can be exposed?
The issue can disclose names and comments associated with votes or comments from restricted polls. It affects unscoped lookups used by the vote, vote_delete, vote_assign, and delete_comment GET requests.
Are restricted polls protected from this disclosure?
No. An attacker can combine a public poll slug with vote or comment IDs belonging to another poll, allowing data from restricted polls to be read.
Which releases are affected?
Bitpoll through version 0.11.0 is affected.