Medium severity5.3NVD Advisory· Published Nov 10, 2026
CVE-2026-125369
CVE-2026-125369
Description
Bitpoll through 0.11.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read votes and comments from other polls via unscoped object lookups in views.py. Attackers can pair any public poll slug with sequential vote or comment IDs in vote, vote_delete, vote_assign, or delete_comment GET requests to read names and comments from restricted polls.
Affected products
1Patches
Vulnerability mechanics
References
4- github.com/fsinfuhh/Bitpoll/blob/0.11.0/bitpoll/poll/views.pynvd
- github.com/fsinfuhh/Bitpoll/commit/71013d36a4d587e672eba225d94f7b94cd412ef9nvd
- github.com/fsinfuhh/Bitpoll/issues/206nvd
- www.vulncheck.com/advisories/bitpoll-through-0.11.0-unauthenticated-vote-and-comment-disclosure-via-unscoped-lookupsnvd
News mentions
0No linked articles in our index yet.