CVE-2025-66027 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.6, an information disclosure vulnerability exposes participant details, includi…
High CVSS: 7.1

CVE-2025-66027

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.6, an information disclosure vulnerability exposes participant details, including names and email addresses through the /api/trpc/polls.get,polls.participants.list endpoint, even when Pro privacy features are enabled. This bypasses intended privacy controls that should prevent participants from viewing other users’ personal information. This issue has been patched in version 4.5.6.
Vendor
Rallly
Product
Rallly
CWE
CWE-200
Yayın Tarihi
2025-11-29 01:16:02
Güncelleme
2025-12-03 20:25:53
Source Identifier
security-advisories@github.com
KEV Date Added
-

Kategoriler

CWE-200 Rallly HIGH Rallly 2025

Referanslar

https://github.com/lukevella/rallly/commit/59738c04f9a8ec25f0af5ce20ad0eab6cf134963 https://github.com/lukevella/rallly/releases/tag/v4.5.6 https://github.com/lukevella/rallly/security/advisories/GHSA-65wg-8xgw-f3fg https://github.com/lukevella/rallly/security/advisories/GHSA-65wg-8xgw-f3fg