CVE-2025-66027CWE-200CWE-284CWE-359broken-access-controlinformation-disclosure

CVE-2025-66027

Medium · published November 29, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
27.6
In the wild
Unconfirmed
What it is

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.6, an information disclosure vulnerability exposes participant details, including names and email addresses through the /api/trpc/polls.get,polls.participants.list endpoint, even when Pro privacy features are enabled. This bypasses intended privacy controls that should prevent participants from viewing other users’ personal information. This issue has been patched in version 4.5.6.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00352 · 27.6th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-284 · Improper Access Control; CWE-359 · Exposure of Private Personal Information to an Unauthorized Actor
Published
2025-11-29T06:16Z
Affected products (1)
ProductVersionsFixed in
rallly/rallly< 4.5.64.5.6
References (4)
https://github.com/lukevella/rallly/commit/59738c04f9a8ec25f0af5ce20ad0eab6cf134963 · [email protected]https://github.com/lukevella/rallly/releases/tag/v4.5.6 · [email protected]https://github.com/lukevella/rallly/security/advisories/GHSA-65wg-8xgw-f3fg · [email protected]https://github.com/lukevella/rallly/security/advisories/GHSA-65wg-8xgw-f3fg · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 29 NOV 00:43Z
    Rallly Information Disclosure Vulnerability in Participant API Leaks Names and Emails Despite Pro Privacy Settings
    cvelistv5