CVE-2026-92565 MEDIUM

CVE-2026-92565: Rallly before 4.15.0 Information Disclosure via polls.get

Vendor Lukevella

Product rallly

Weakness CWE-359

Published September 16, 2026

Last update September 18, 2026

View on NVD All CVEs

CVSS base score

5.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality Low

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Rallly before 4.15.0 contains an information disclosure vulnerability in the polls.get tRPC procedure that returns scheduled-event invitee names and email addresses to unauthenticated callers. Attackers can access a poll's urlId from public invite links to retrieve sensitive invitee information regardless of privacy settings.

Key dates

02Disclosure timeline

September 16, 2026 CVE published

September 18, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-92565 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/359.html AskarLabs — CWE-359 write-up Exposure of Private Personal Information to an Unauthorized Actor

Related vulnerabilities

04Related CVE

CVE-2024-11396 Event monster <= 1.4.3 - Information Exposure Via Visitors List Export CVE-2024-13216 HT Event – WordPress Event Manager Plugin for Elementor <= 1.4.7 - Authenticated (Contributor+) Sensitive Information Exposure via HT Event: Sponsor CVE-2023-6630 Contact Form 7 – Dynamic Text Extension <= 4.1.0 - Insecure Direct Object Reference CVE-2024-12041 Directorist – AI-Powered WordPress Business Directory Plugin with Classified Ads Listings <= 8.0.12 - Unauthenticated User Information Exposure CVE-2024-13217 Jeg Elementor Kit <= 2.6.11 - Authenticated (Contributor+) Sensitive Information Exposure via Countdown and Off-Canvas