CVE-2026-92565: Exposure of Private Personal Information to an Unauthorized Actor in lukevella rallly
Rallly before 4.15.0 contains an information disclosure vulnerability in the polls.get tRPC procedure that returns scheduled-event invitee names and email addresses to unauthenticated callers. Attackers can access a poll's urlId from public invite links to retrieve sensitive invitee information regardless of privacy settings.
AI Analysis
Technical Summary
CVE-2026-92565 is an information disclosure vulnerability in the lukevella Rallly application prior to version 4.15.0. The issue exists in the polls.get tRPC procedure, which returns sensitive invitee information such as names and email addresses to unauthenticated callers. Attackers can exploit this by accessing a poll's urlId from public invite links, bypassing privacy controls to obtain private personal data of scheduled-event invitees.
Potential Impact
The vulnerability allows unauthorized actors to access private personal information (names and email addresses) of event invitees without authentication. This exposure can lead to privacy violations and potential misuse of personal data. There is no indication of impact on data integrity or availability.
Mitigation Recommendations
A fix is available in Rallly version 4.15.0. Users should upgrade to version 4.15.0 or later to remediate this information disclosure vulnerability. No other mitigation guidance is provided.
CVE-2026-92565: Exposure of Private Personal Information to an Unauthorized Actor in lukevella rallly
Description
Rallly before 4.15.0 contains an information disclosure vulnerability in the polls.get tRPC procedure that returns scheduled-event invitee names and email addresses to unauthenticated callers. Attackers can access a poll's urlId from public invite links to retrieve sensitive invitee information regardless of privacy settings.
CVSS v3.1
Score 5.3medium
Affected software
lukevella
rallly
pkg:github/lukevella/ralllyRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-92565 is an information disclosure vulnerability in the lukevella Rallly application prior to version 4.15.0. The issue exists in the polls.get tRPC procedure, which returns sensitive invitee information such as names and email addresses to unauthenticated callers. Attackers can exploit this by accessing a poll's urlId from public invite links, bypassing privacy controls to obtain private personal data of scheduled-event invitees.
Potential Impact
The vulnerability allows unauthorized actors to access private personal information (names and email addresses) of event invitees without authentication. This exposure can lead to privacy violations and potential misuse of personal data. There is no indication of impact on data integrity or availability.
Mitigation Recommendations
A fix is available in Rallly version 4.15.0. Users should upgrade to version 4.15.0 or later to remediate this information disclosure vulnerability. No other mitigation guidance is provided.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-16T13:34:38.064Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aaaabfd55bf5e2cf5bf8d4a
Added to database: 09/16/2026, 14:47:25 UTC
Last enriched: 09/16/2026, 15:02:13 UTC
Last updated: 09/17/2026, 02:06:17 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.