CVE-2025-66027

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2025-66027

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-66027.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2025-66027

Aliases

GHSA-65wg-8xgw-f3fg

Published

2025-11-29T00:43:02.452Z

Modified

2025-11-29T02:57:46.954690Z

Severity

7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N CVSS Calculator

Summary

Rallly Information Disclosure Vulnerability in Participant API Leaks Names and Emails Despite Pro Privacy Settings

Details

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.6, an information disclosure vulnerability exposes participant details, including names and email addresses through the /api/trpc/polls.get,polls.participants.list endpoint, even when Pro privacy features are enabled. This bypasses intended privacy controls that should prevent participants from viewing other users’ personal information. This issue has been patched in version 4.5.6.

Database specific

{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66027.json",
    "cwe_ids": [
        "CWE-200",
        "CWE-284",
        "CWE-359"
    ]
}

References

Affected packages

Git / github.com/lukevella/rallly

Affected ranges

Type

GIT

Repo

https://github.com/lukevella/rallly

Events

Introduced

Fixed

771aef31bad7b3ae3df6f43392496414308e9163

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.5.6"
        }
    ]
}