VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Nov 29, 2025· Updated Jun 17, 2026

CVE-2025-66027

CVE-2025-66027

Description

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.6, an information disclosure vulnerability exposes participant details, including names and email addresses through the /api/trpc/polls.get,polls.participants.list endpoint, even when Pro privacy features are enabled. This bypasses intended privacy controls that should prevent participants from viewing other users’ personal information. This issue has been patched in version 4.5.6.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • Lukevella/Ralllyv52 versions
    < 4.5.6+ 1 more
    • (no CPE)range: < 4.5.6
    • (no CPE)range: <4.5.6
  • Rallly/Ralllyllm-fuzzy2 versions
    <4.5.6+ 1 more
    • (no CPE)range: <4.5.6
    • cpe:2.3:a:rallly:rallly:*:*:*:*:*:*:*:*range: <4.5.6

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.