CVE-2026-92565: Rallly Information Disclosure Vulnerability

CVE-2026-92565 Overview

CVE-2026-92565 is an information disclosure vulnerability in Rallly, an open-source scheduling and polling application, affecting all versions before 4.15.0. The flaw resides in the polls.get tRPC procedure, which returns scheduled-event invitee names and email addresses to unauthenticated callers. Attackers who obtain a poll's urlId from public invite links can retrieve sensitive invitee data regardless of the poll's privacy settings. The issue is categorized under [CWE-359: Exposure of Private Personal Information to an Unauthorized Actor].

Critical Impact
Unauthenticated attackers can harvest invitee names and email addresses from any Rallly poll by knowing only the public urlId, exposing personally identifiable information (PII) at scale.

Affected Products

Rallly (self-hosted and hosted scheduling application) versions before 4.15.0
Deployments exposing the polls.get tRPC endpoint to unauthenticated network callers
Instances relying on default privacy settings to protect scheduled-event attendee data

Discovery Timeline

2026-09-16 - CVE-2026-92565 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92565

Vulnerability Analysis

Rallly exposes a tRPC (TypeScript Remote Procedure Call) endpoint named polls.get that returns metadata about a poll identified by its urlId. Prior to version 4.15.0, the Prisma database selection object embedded in this procedure requested the full invites relation, including inviteeName, inviteeEmail, inviteeTimeZone, and status for every scheduled attendee.

Because the polls.get procedure does not require authentication and the urlId is publicly shared in invitation links, any party holding an invite URL can enumerate the complete attendee list. The endpoint returned the invite data even when the poll was configured with restrictive privacy settings, effectively bypassing the intended access control.

The vulnerability is a business logic and access control flaw rather than a memory-safety issue. It allows harvesting of PII including names and email addresses without triggering authentication failures or rate-limit anomalies visible to defenders.

Root Cause

The root cause is over-inclusive data projection in the Prisma query backing the polls.get tRPC route in apps/web/src/trpc/routers/polls.ts. The scheduledEvent.select clause included the invites sub-selection with attendee identity fields. Server-side authorization did not gate these fields for anonymous callers.

Attack Vector

Exploitation requires only network access to the Rallly instance and knowledge of a poll's urlId, which is distributed in the invitation link shared by organizers. An attacker calls the polls.get tRPC endpoint with the target urlId and parses the JSON response to extract invitee names and email addresses. No credentials, user interaction, or elevated privileges are required.

typescript

// Security patch in apps/web/src/trpc/routers/polls.ts
// Source: https://github.com/lukevella/rallly/commit/0db11a2cd9e48656d08773e4be6de0e7df584a00
              end: true,
              allDay: true,
              status: true,
-              invites: {
-                select: {
-                  id: true,
-                  inviteeName: true,
-                  inviteeEmail: true,
-                  inviteeTimeZone: true,
-                  status: true,
-                },
-              },
            },
          },
        },

The corresponding type definition in apps/web/src/trpc/client/types.ts was also updated to remove the attendees array from the response contract, eliminating the exposed fields end to end.

Detection Methods for CVE-2026-92565

Indicators of Compromise

Repeated tRPC requests to the polls.get procedure from a single IP or user agent across many distinct urlId values
Anonymous (unauthenticated) HTTP calls to the polls.get endpoint returning large response payloads containing inviteeEmail fields
Access log entries showing enumeration patterns against the /api/trpc/polls.get path prior to upgrading to Rallly 4.15.0

Detection Strategies

Review web server and reverse proxy logs for high-volume requests to the polls.get tRPC route, particularly from clients without session cookies.
Correlate poll urlId access with the originating source to identify scraping behavior inconsistent with normal invitee traffic.
Deploy a Web Application Firewall (WAF) rule that flags unauthenticated tRPC calls returning response bodies exceeding the size expected for poll metadata alone.

Monitoring Recommendations

Enable detailed application logging on the tRPC router and alert on anomalous request rates against polls.get.
Track outbound response sizes for the polls.get endpoint and baseline normal traffic to detect bulk data extraction.
Monitor for user reports of unsolicited email addressed to poll invitees, which may indicate downstream misuse of leaked addresses.

How to Mitigate CVE-2026-92565

Immediate Actions Required

Upgrade all Rallly deployments to version 4.15.0 or later, which removes the invitee fields from the polls.get response.
Audit access logs for prior unauthenticated calls to polls.get and identify polls whose invitee data may have been exposed.
Notify poll organizers and, where required by regulation, affected invitees if evidence of exploitation is found.

Patch Information

The fix is delivered in Rallly release v4.15.0 and implemented in pull request #3247 and commit 0db11a2. The patch removes the invites sub-selection from the scheduledEvent Prisma query in apps/web/src/trpc/routers/polls.ts and drops the attendees field from the client-side response type. Refer to the VulnCheck advisory for the full disclosure details.

Workarounds

Restrict network access to the Rallly instance so that only authenticated users on a trusted network can reach the tRPC endpoints until the upgrade is applied.
Rotate urlId values by recreating exposed polls after upgrading, so previously shared identifiers can no longer be queried against a patched backend.
Place the application behind a reverse proxy that requires authentication for /api/trpc/polls.get requests originating from anonymous sessions.

bash

# Verify the running Rallly version and upgrade via Docker
docker inspect rallly --format '{{.Config.Image}}'
docker pull lukevella/rallly:4.15.0
docker stop rallly && docker rm rallly
docker run -d --name rallly --env-file .env -p 3000:3000 lukevella/rallly:4.15.0