CVE-2026-92565 — Rallly before 4.15.0 Information Disclosure via polls.get
Rallly before 4.15.0 contains an information disclosure vulnerability in the polls.get tRPC procedure that returns scheduled-event invitee names and email addresses to unauthent…
Published: 2026-09-16 · CVSS: 6.9 · CVSS 4.0
Rallly before 4.15.0 contains an information disclosure vulnerability in the polls.get tRPC procedure that returns scheduled-event invitee names and email addresses to unauthenticated callers. Attackers can access a poll's urlId from public invite links to retrieve sensitive invitee information regardless of privacy settings.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7