HIGH🇬🇧 English

CVE-2025-66027

CVSS 7.1v4.0pub. 2025-11-29upd. 2025-12-03

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.6, an information disclosure vulnerability exposes participant details, including names and email addresses through the /api/trpc/polls.get,polls.participants.list endpoint, even when Pro privacy features are enabled. This bypasses intended privacy controls that should prevent participants from viewing other users’ personal information. This issue has been patched in version 4.5.6.

oryginał EN
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Rallly

    APP
    Rallly
    < 4.5.6
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
CWE
Referencje

Powiązane podatności

CVE-2025-65021CRITICAL9.1PL ✓ten sam produkt

IDOR w Rallly — nieautoryzowane finalizowanie ankiet innych użytkowników

CVE-2025-47781CRITICAL9.8PL ✓ten sam produkt

Rallly – brute force tokenu logowania umożliwia przejęcie konta

CVE-2025-65034HIGH8.1ten sam produkt

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an improper authorization ...

CVE-2025-65029HIGH8.1ten sam produkt

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an insecure direct object ...

CVE-2025-65030HIGH7.1ten sam produkt

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an authorization flaw in t...