CVE Feed

    Dashboard / CVE / CVE-2026-92565

    CVE-2026-92565

    Rallly before 4.15.0 contains an information disclosure vulnerability in the polls.get tRPC procedure that returns scheduled-event invitee names and email addresses to unauthenticated callers. Attackers can access a poll's urlId from public invite links to retrieve sensitive invitee information regardless of privacy settings.

    Published:Sep 16, 2026
    Last Modified:Sep 18, 2026
    EPS:Sep 16, 2026
    EPSS Score:0.00363
    CVSS Score:5.3

    Affected Products

    Vendor
    Rallly
    Product
    Rallly

    Exploits

    No exploit reference

    Related CVEs

    CVE-2025-66027 (CVSS 7.1) — Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.6, an information disclosure …
    CVE-2025-65034 (CVSS 8.1) — Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an improper authorization …
    CVE-2025-65033 (CVSS 8.1) — Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an authorization flaw in t…
    CVE-2025-65032 (CVSS 6.5) — Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object …
    CVE-2025-65031 (CVSS 6.5) — Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an improper authorization …
    CVE-2025-65030 (CVSS 7.1) — Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an authorization flaw in t…
    CVE-2025-65029 (CVSS 8.1) — Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an insecure direct object …
    CVE-2025-65021 (CVSS 9.1) — Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object …
    CVE-2025-65020 (CVSS 6.5) — Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object …
    CVE-2025-65028 (CVSS 6.5) — Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an insecure direct object …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High