CVE-2026-92565 in Rallly
Summary
by MITRE • 09/16/2026
Rallly before 4.15.0 contains an information disclosure vulnerability in the polls.get tRPC procedure that returns scheduled-event invitee names and email addresses to unauthenticated callers. Attackers can access a poll's urlId from public invite links to retrieve sensitive invitee information regardless of privacy settings.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The Rallly application, prior to version 4.15.0, contains a critical information disclosure vulnerability within its polls.get tRPC procedure. This flaw allows unauthenticated attackers to access sensitive personal data associated with scheduled events without requiring valid authentication credentials or proper authorization tokens. The core of the issue lies in the server-side implementation of the API endpoint responsible for retrieving poll details and participant information. Instead of strictly enforcing privacy settings defined by the event creator, such as restricting visibility to only confirmed attendees or anonymous participants, the backend logic fails to validate these constraints before returning data. Consequently, any individual who possesses a public invite link containing the unique urlId associated with a specific poll can invoke this procedure directly and receive a response populated with the names and email addresses of all invited individuals.
This vulnerability represents a significant breach of confidentiality, as it exposes personally identifiable information (PII) to unauthorized parties. The attacker's workflow is straightforward: they locate or construct a public invite link for any Rallly poll, extract the urlId parameter from that URL, and then send an HTTP request to the polls.get endpoint using this identifier. Because the authentication check is either missing or incorrectly implemented at the API level, the server processes the request as if it were coming from an authorized user with full access rights. This behavior effectively bypasses any intended privacy controls, rendering settings such as hiding participant identities ineffective against external actors who can interact directly with the underlying application programming interface rather than through the standard web client interface.
From a technical classification perspective, this vulnerability aligns closely with CWE-200: Exposure of Sensitive Information to an Unauthorized Actor and CWE-862: Missing Authorization. The failure occurs because the system does not properly enforce access control policies on sensitive data resources. In terms of offensive security frameworks, this behavior is characteristic of ATT&CK technique T1539: Steal Web Session Cookie, although in this specific instance, it involves direct API exploitation rather than session hijacking, and falls under broader categories of unauthorized information retrieval such as T1078: Valid Accounts if the attacker were to use stolen credentials, but here it is more accurately described as an improper access control flaw leading to data exposure. The impact extends beyond mere privacy violations; exposed email addresses can be leveraged for targeted phishing campaigns, credential stuffing attacks, or spamming activities, thereby compromising the security posture of both individual users and organizations that rely on Rallly for scheduling sensitive meetings.
To mitigate this vulnerability, immediate action is required to patch the application to version 4.15.0 or later where these access control checks have been corrected. For environments unable to upgrade immediately, a temporary workaround involves implementing strict input validation and authorization middleware at the reverse proxy or API gateway level. This middleware should verify that any request targeting the polls.get endpoint includes valid authentication headers corresponding to an account with explicit permission to view the specific poll's participant list. Additionally, developers must audit other tRPC procedures for similar patterns where privacy settings are not rigorously enforced during data serialization and response generation. Regular security audits focusing on API endpoints and their adherence to defined access control policies are essential to prevent recurrence of such information disclosure flaws in future releases.