CVE-2026-92565— Rallly before 4.15.0 Information Disclosure via polls.get
Quick assessment
Affected
lukevella rallly
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Rallly 在 4.15.0 版本之前存在一个信息泄露漏洞，位于 tRPC 处理程序。该处理程序会向未认证调用者返回计划活动参与者的姓名和电子邮件地址。攻击者可以通过公共邀请链接获取投票的 ，从而无视隐私设置，获取敏感的参与者信息。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92565
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Rallly before 4.15.0 Information Disclosure via polls.get
Source: CVE Program / CVE List V5
Vulnerability Description
Rallly before 4.15.0 contains an information disclosure vulnerability in the polls.get tRPC procedure that returns scheduled-event invitee names and email addresses to unauthenticated callers. Attackers can access a poll's urlId from public invite links to retrieve sensitive invitee information regardless of privacy settings.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
侵犯隐私
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-92565
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92565
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-92565 (2)
Vendor Advisories for CVE-2026-92565 (1)
-
🔗 Rallly before 4.15.0 Information Disclosure via polls.get | Advisories | VulnCheck third-party-advisory
Vendor Pages for CVE-2026-92565 (1)
-
🔗 Release v4.15.0 · lukevella/rallly · GitHub release-notes
Other References for CVE-2026-92565 (1)
IV. Related Vulnerabilities
Same product: rallly
-
CVE-2026-6493
lukevella rallly Reset Password reset-password-form.tsx cros -
CVE-2025-66027
Rallly Information Disclosure Vulnerability in Participant A -
CVE-2025-65034
Rallly Improper Authorization Allows Reopening of Any Finali -
CVE-2025-65033
Rallly Broken Authorization: Any User Can Pause or Resume An -
CVE-2025-65032
Rallly Has an IDOR Vulnerability in Participant Rename Funct
Same vendor: lukevella
-
CVE-2026-6493
lukevella rallly Reset Password reset-password-form.tsx cros -
CVE-2025-66027
Rallly Information Disclosure Vulnerability in Participant A -
CVE-2025-65034
Rallly Improper Authorization Allows Reopening of Any Finali -
CVE-2025-65033
Rallly Broken Authorization: Any User Can Pause or Resume An -
CVE-2025-65032
Rallly Has an IDOR Vulnerability in Participant Rename Funct
Same weakness: CWE-359
-
CVE-2026-76855
Netcore NR255-V 1.5.130703 Cross-User Session Disclosure via -
CVE-2026-88875
AVideo Incomplete API Sanitization Information Disclosure -
CVE-2026-73008
Windows Biometric Service Information Disclosure Vulnerabili -
CVE-2026-69351
Windows Universal Plug and Play (UPnP) Device Host Informati -
CVE-2026-21827
HCL Connections is vulnerable to an information disclosure v
V. Comments for CVE-2026-92565
No comments yet