CVE-2026-125369
Received Received - Intake

Insecure Direct Object Reference in Bitpoll Exposes Votes and Comments

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: VulnCheck

Description
Bitpoll through 0.11.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read votes and comments from other polls via unscoped object lookups in views.py. Attackers can pair any public poll slug with sequential vote or comment IDs in vote, vote_delete, vote_assign, or delete_comment GET requests to read names and comments from restricted polls.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-125369
EUVD
EUVD-2026-120532

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
fsinfuhh Bitpoll From 0 (inc) to 0.11.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an insecure direct object reference in Bitpoll through version 0.11.0. It allows unauthenticated attackers to read votes and comments from restricted polls by exploiting unscoped object lookups in views.py. Attackers can combine a public poll's URL with sequential vote or comment IDs to access private data.

Detection Guidance

To detect this vulnerability, check Bitpoll instances running version 0.11.0 or earlier. Test by accessing vote, vote_delete, vote_assign, or delete_comment endpoints with arbitrary poll slugs and sequential IDs. If restricted data is exposed, the system is vulnerable.

Impact Analysis

This vulnerability could allow unauthorized users to view sensitive information such as votes, comments, and user names from polls that should be restricted. It may lead to privacy breaches, data leaks, or misuse of poll results. The impact includes potential exposure of confidential meeting schedules or sensitive poll data.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by exposing personal or sensitive data without authorization. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. Unauthorized access to poll data may violate these regulations, resulting in legal and financial penalties.

Mitigation Strategies

Upgrade Bitpoll to the latest patched version. Apply the fix from commit 71013d3 which adds poll scoping to object lookups. Ensure all GET requests enforce access controls like require_login or require_invitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-125369. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...