Quick answers
- Is CVE-2026-92565 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-92565 being exploited in the wild.
- How severe is CVE-2026-92565?
- Medium severity, with a CVSS score of 5.3, published 16 September 2026.
- Which products and versions are affected?
- Rallly before 4.15.0.
- Is there a fix for CVE-2026-92565?
- A patch was published on 2026-09-16: Fix available in version 4.15.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-92565 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-92565?
- Check whether you run Rallly at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The polls.get tRPC procedure in Rallly before 4.15.0 fails to properly enforce authentication and authorization checks, allowing unauthenticated callers to retrieve invitee names and email addresses. The vulnerability stems from insufficient access control on a network-facing RPC endpoint that processes poll-related queries. An attacker can supply a poll's urlId (which is exposed in public invite links) to the endpoint to extract sensitive invitee information regardless of the poll's privacy settings. The vulnerability requires network access to the Rallly instance but no authentication or user interaction. Patches are available in version 4.15.0 and later.
Affected products
- Rallly Rallly before 4.15.0
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Fix available in version 4.15.0