# CVE-2026-92565: Rallly information disclosure in polls.get tRPC endpoint

Source: https://junglewise.ai/threats/cve-2026-92565-rallly-information-disclosure-in-polls-get-trpc-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92565 · Severity: medium · CVSS 5.3 · Published 2026-09-16

Rallly is an open-source scheduling and event organization tool. A vulnerability in its polls.get endpoint allows attackers to retrieve names and email addresses of meeting invitees without authentication, exposing sensitive participant information even when privacy settings are enabled. Attackers can exploit this by accessing a poll's URL identifier from public invitation links.

Technologies: [Rallly](https://junglewise.ai/threats/technologies/rallly). Vendors: [Rallly](https://junglewise.ai/threats/vendors/rallly).

## Quick answers

**Is CVE-2026-92565 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92565 being exploited in the wild.

**How severe is CVE-2026-92565?** Medium severity, with a CVSS score of 5.3, published 16 September 2026.

**Which products and versions are affected?** Rallly before 4.15.0.

**Is there a fix for CVE-2026-92565?** A patch was published on 2026-09-16: Fix available in version 4.15.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92565 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-92565?** Check whether you run Rallly at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The polls.get tRPC procedure in Rallly before 4.15.0 fails to properly enforce authentication and authorization checks, allowing unauthenticated callers to retrieve invitee names and email addresses. The vulnerability stems from insufficient access control on a network-facing RPC endpoint that processes poll-related queries. An attacker can supply a poll's urlId (which is exposed in public invite links) to the endpoint to extract sensitive invitee information regardless of the poll's privacy settings. The vulnerability requires network access to the Rallly instance but no authentication or user interaction. Patches are available in version 4.15.0 and later.

## Affected products

- Rallly Rallly before 4.15.0

## Timeline

- 2026-09-16: disclosed
- 2026-09-16: patched: Fix available in version 4.15.0

## References

- [https://github.com/lukevella/rallly](https://github.com/lukevella/rallly)
- [https://github.com/lukevella/rallly/blob/885bfaf4313f427a60c5349646c5b69d863750db/apps/web/src/trpc/routers/polls.ts](https://github.com/lukevella/rallly/blob/885bfaf4313f427a60c5349646c5b69d863750db/apps/web/src/trpc/routers/polls.ts)

## Related threats

- [Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.6, an information disclosure…](https://junglewise.ai/threats/cve-2025-66027-rallly-is-an-open-source-scheduling-and-collaboration-tool-prior)
- [Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an improper authorization…](https://junglewise.ai/threats/cve-2025-65034-rallly-is-an-open-source-scheduling-and-collaboration-tool-prior)
- [Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an authorization flaw in the poll…](https://junglewise.ai/threats/cve-2025-65033-rallly-is-an-open-source-scheduling-and-collaboration-tool-prior)
- [Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object…](https://junglewise.ai/threats/cve-2025-65032-rallly-is-an-open-source-scheduling-and-collaboration-tool-prior)
- [Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an improper authorization flaw in…](https://junglewise.ai/threats/cve-2025-65031-rallly-is-an-open-source-scheduling-and-collaboration-tool-prior)