CVE-2025-66027
📋 TL;DR
This CVE describes an information disclosure vulnerability in Rallly, an open-source scheduling tool. It allows unauthorized access to participant names and email addresses through a specific API endpoint, bypassing Pro privacy features. All Rallly instances running versions before 4.5.6 are affected.
💻 Affected Systems
- Rallly
📦 What is this software?
Rallly by Rallly
⚠️ Risk & Real-World Impact
Worst Case
Attackers could harvest sensitive personal information (names and email addresses) of all participants in polls, potentially enabling targeted phishing campaigns or identity theft.
Likely Case
Unauthorized users accessing participant contact information they shouldn't be able to see, violating privacy expectations and potentially exposing users to spam or unwanted contact.
If Mitigated
With proper access controls and network segmentation, impact is limited to authorized users who might still bypass intended privacy settings.
🎯 Exploit Status
Exploitation requires access to the API endpoint but doesn't require authentication beyond what's needed to access polls.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.5.6
Vendor Advisory: https://github.com/lukevella/rallly/security/advisories/GHSA-65wg-8xgw-f3fg
Restart Required: Yes
Instructions:
1. Backup your Rallly instance and database
2. Update to version 4.5.6 using your deployment method (Docker, manual, etc.)
3. Restart the Rallly service
4. Verify the update was successful
🔧 Temporary Workarounds
API Endpoint Restriction
allBlock or restrict access to the vulnerable endpoint /api/trpc/polls.get,polls.participants.list
# Example nginx config to block endpoint
location /api/trpc/polls.get,polls.participants.list {
deny all;
return 403;
}
Network Segmentation
allRestrict network access to Rallly API endpoints to authorized users only
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach the Rallly API
- Monitor for unusual access patterns to the vulnerable endpoint
🔍 How to Verify
Check if Vulnerable:
Check if your Rallly version is below 4.5.6 and test if the /api/trpc/polls.get,polls.participants.list endpoint returns participant details when Pro privacy is enabled.Check Version:
Check the Rallly web interface settings or run: docker exec <container_name> node -e "console.log(require('./package.json').version)"Verify Fix Applied:
After updating to 4.5.6, verify that the endpoint no longer returns participant details when Pro privacy features are enabled.📡 Detection & Monitoring
Log Indicators:
- Unusual number of requests to /api/trpc/polls.get,polls.participants.list
- Requests from unexpected IP addresses to the vulnerable endpoint
Network Indicators:
- Traffic patterns showing enumeration of poll IDs followed by access to participant endpoints
SIEM Query:
source="rallly" AND (uri_path="/api/trpc/polls.get,polls.participants.list" OR uri_path CONTAINS "polls.participants")