CVE-2026-92565
Last modified
CVE-2026-92565 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. Rallly before 4.15.0 contains an information disclosure vulnerability in the polls.get tRPC procedure that returns scheduled-event invitee names and email addresses to unauthenticated callers. Attackers can access a poll's urlId from public invite links to retrieve sensitive invitee information regardless of privacy settings..
Description
Rallly before 4.15.0 contains an information disclosure vulnerability in the polls.get tRPC procedure that returns scheduled-event invitee names and email addresses to unauthenticated callers. Attackers can access a poll's urlId from public invite links to retrieve sensitive invitee information regardless of privacy settings.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| lukevella | rallly | < 4.15.0 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-92565?
How severe is CVE-2026-92565?
How do I fix CVE-2026-92565?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-92526A flaw has been found in itsourcecode Leave Management Syste…6.3
- CVE-2026-92527A vulnerability has been found in chatwoot up to 4.17.1. Thi…6.3
- CVE-2026-9253The WP Cost Estimation & Payment Forms Builder (E&P Forms) p…7.2
- CVE-2026-9254An unauthenticated OS command injection vulnerability exists…8.7
- CVE-2026-9255Missing input source validation in the tool authorization pr…8.4
- CVE-2026-9256NGINX Plus and NGINX Open Source have a vulnerability in the…8.1
- CVE-2026-92566DataGear through 6.0.0 contains a server-side request forger…8.2
- CVE-2026-92567TDuck survey form through version 5.0 contains an authorizat…6.5
- CVE-2026-92568MLRun through 1.11.0 contains a server-side request forgery …5.4
- CVE-2026-92569Hippo4j through 1.5.0 contains a server-side request forgery…4.3
- CVE-2026-92570reNgine through 2.2.0 contains an authorization bypass vulne…6.5
- CVE-2026-92571Rejected reason: CVE ID reserved in error and not assigned t…
Are you affected by CVE-2026-92565?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST