CVE-2025-66027

Katalog CVE

CVSS 6.5 · Medium EPSS 0,35%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada rallly. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.6, an information disclosure vulnerability exposes participant details, including names and email addresses through the /api/trpc/polls.get,polls.participants.list endpoint, even when Pro privacy features are enabled. This bypasses intended privacy controls that should prevent participants from viewing other users’ personal information. This issue has been patched in version 4.5.6.

Rincian

Terbit di NVD

29 November 2025

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-284: Improper Access Control
CWE-359: Exposure of Private Personal Information to an Unauthorized Actor

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 26,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/lukevella/rallly/security/advisories/GHSA-65wg-8xgw-f3fg exploit · advisory vendor
• https://github.com/lukevella/rallly/commit/59738c04f9a8ec25f0af5ce20ad0eab6cf134963 patch
• https://github.com/lukevella/rallly/releases/tag/v4.5.6 release notes