CVE-2025-66027

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.6, an information disclosure vulnerability exposes participant details, including names and email addresses through the /api/trpc/polls.get,polls.participants.list endpoint, even when Pro privacy features are enabled. This bypasses intended privacy controls that should prevent participants from viewing other users’ personal information. This issue has been patched in version 4.5.6.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/lukevella/rallly/commit/59738c04f9a8ec25f0af5ce20ad0eab6cf134963	Patch
https://github.com/lukevella/rallly/releases/tag/v4.5.6	Release Notes
https://github.com/lukevella/rallly/security/advisories/GHSA-65wg-8xgw-f3fg	Exploit Vendor Advisory
https://github.com/lukevella/rallly/security/advisories/GHSA-65wg-8xgw-f3fg	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:rallly:rallly:*:*:*:*:*:*:*:*

History

07 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Rallly es una herramienta de programación y colaboración de código abierto. Antes de la versión 4.5.6, una vulnerabilidad de revelación de información expone los detalles de los participantes, incluyendo nombres y direcciones de correo electrónico a través del endpoint /API/trpc/polls.get,polls.participants.list, incluso cuando las funciones de privacidad Pro están habilitadas. Esto elude los controles de privacidad previstos que deberían evitar que los participantes vean la información personal de otros usuarios. Este problema ha sido parcheado en la versión 4.5.6.

Information

Published : 2025-11-29 01:16

Updated : 2026-10-07 20:10

NVD link : CVE-2025-66027

Mitre link : CVE-2025-66027

CVE.ORG link : CVE-2025-66027

JSON object : View

Products Affected

rallly

rallly

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-284

Improper Access Control

CWE-359

Exposure of Private Personal Information to an Unauthorized Actor

{"id": "CVE-2025-66027", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66027", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-01T14:09:27.427625Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "lukevella", "product": "rallly", "versions": [{"status": "affected", "version": "< 4.5.6"}]}]}], "published": "2025-11-29T01:16:02.807", "references": [{"url": "https://github.com/lukevella/rallly/commit/59738c04f9a8ec25f0af5ce20ad0eab6cf134963", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/lukevella/rallly/releases/tag/v4.5.6", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/lukevella/rallly/security/advisories/GHSA-65wg-8xgw-f3fg", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/lukevella/rallly/security/advisories/GHSA-65wg-8xgw-f3fg", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-359"}]}], "descriptions": [{"lang": "en", "value": "Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.6, an information disclosure vulnerability exposes participant details, including names and email addresses through the /api/trpc/polls.get,polls.participants.list endpoint, even when Pro privacy features are enabled. This bypasses intended privacy controls that should prevent participants from viewing other users\u2019 personal information. This issue has been patched in version 4.5.6."}, {"lang": "es", "value": "Rallly es una herramienta de programaci\u00f3n y colaboraci\u00f3n de c\u00f3digo abierto. Antes de la versi\u00f3n 4.5.6, una vulnerabilidad de revelaci\u00f3n de informaci\u00f3n expone los detalles de los participantes, incluyendo nombres y direcciones de correo electr\u00f3nico a trav\u00e9s del endpoint /API/trpc/polls.get,polls.participants.list, incluso cuando las funciones de privacidad Pro est\u00e1n habilitadas. Esto elude los controles de privacidad previstos que deber\u00edan evitar que los participantes vean la informaci\u00f3n personal de otros usuarios. Este problema ha sido parcheado en la versi\u00f3n 4.5.6."}], "lastModified": "2026-10-07T20:10:01.970", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rallly:rallly:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "42A20139-EE62-4B67-AF70-57374DD703C6", "versionEndExcluding": "4.5.6"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}