Executive brief
Rallly is an open-source scheduling and event organization tool. A vulnerability in its polls.get endpoint allows attackers to retrieve names and email addresses of meeting invitees without authentication, exposing sensitive participant information even when privacy settings are enabled. Attackers can exploit this by accessing a poll's URL identifier from public invitation links.
Technical details
The polls.get tRPC procedure in Rallly before 4.15.0 fails to properly enforce authentication and authorization checks, allowing unauthenticated callers to retrieve invitee names and email addresses. The vulnerability stems from insufficient access control on a network-facing RPC endpoint that processes poll-related queries. An attacker can supply a poll's urlId (which is exposed in public invite links) to the endpoint to extract sensitive invitee information regardless of the poll's privacy settings. The vulnerability requires network access to the Rallly instance but no authentication or user interaction. Patches are available in version 4.15.0 and later.
Affected products
- Rallly Rallly before 4.15.0
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Fix available in version 4.15.0