Vulnerability · Published Nov 29, 2025 · Assigned by GitHub_M

CVE-2025-66027Rallly Information Disclosure Vulnerability in Participant API Leaks Names and Emails Despite Pro Privacy Settings

High 7.1

In plain English

A high-severity information exposure in rallly from lukevella. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 4.0)7.1High

Exploit odds (30 days)0.4%top 68.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.6, an information disclosure vulnerability exposes participant details, including names and email addresses through the /api/trpc/polls.get,polls.participants.list endpoint, even when Pro privacy features are enabled. This bypasses intended privacy controls that should prevent participants from viewing other users’ personal information. This issue has been patched in version 4.5.6.

Affected products (as reported)

Vendor	Product	Versions
lukevella	rallly	< 4.5.6

Weakness: CWE-200, CWE-284, CWE-359 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

References

https://github.com/lukevella/rallly/security/advisories/GHSA-65wg-8xgw-f3fg x_refsource_CONFIRM
https://github.com/lukevella/rallly/commit/59738c04f9a8ec25f0af5ce20ad0eab6cf134963 x_refsource_MISC
https://github.com/lukevella/rallly/releases/tag/v4.5.6 x_refsource_MISC