Threats tagged 'ghsa-frxv-g6p8-4jv8'

Bitpoll versions through 0.11.0 have an insecure direct object reference (IDOR) vulnerability that allows unauthenticated attackers to read votes and comments from other polls. This occurs due to unscoped object lookups in views.py, enabling attackers to access restricted poll data by manipulating public poll slugs with sequential vote or comment IDs in specific GET requests.