CVE-2026-92565: Rallly before 4.15.0 Information Disclosure via polls.get
Rallly before 4.15.0 contains an information disclosure vulnerability in the polls.get tRPC procedure that returns scheduled-event invitee names and email addresses to unauthenticated callers. Attackers can access a poll's urlId from public invite links to retrieve sensitive invitee information regardless of privacy settings.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Rallly deployments running versions before 4.15.0 are affected. Polls with public invite links are exposed because an unauthenticated caller can obtain the poll's urlId from those links.
What does an attacker need to retrieve the information?
The attacker needs a poll urlId, which can be obtained from a public invite link. No authentication or user interaction is required.
What information can be disclosed?
The polls.get tRPC procedure can return scheduled-event invitee names and email addresses. This disclosure occurs regardless of the poll's privacy settings.