CVE-2025-66027
BaseFortify
Publication date: 2025-11-29
Last updated on: 2025-12-03
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| rallly | rallly | to 4.5.6 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
| CWE-359 | The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected. |
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Rallly, an open-source scheduling and collaboration tool, allows unauthorized information disclosure. Specifically, before version 4.5.6, participant details such as names and email addresses could be accessed through the /api/trpc/polls.get,polls.participants.list endpoint even when Pro privacy features were enabled. This means the intended privacy controls that should prevent participants from viewing other users' personal information were bypassed.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized disclosure of personal information of participants, including their names and email addresses. This could result in privacy breaches, potential phishing attacks, spam, or other misuse of exposed personal data.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability could negatively impact compliance with privacy regulations such as GDPR and HIPAA because it exposes personal information without proper authorization, violating data protection and privacy requirements.
What immediate steps should I take to mitigate this vulnerability?
Upgrade Rallly to version 4.5.6 or later, as this version contains the patch that fixes the information disclosure vulnerability.