CVE-2026-92565: Lukevella Rallly

Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days.

Rallly before 4.15.0 contains an information disclosure vulnerability in the polls.get tRPC procedure that returns scheduled-event invitee names and email addresses to unauthenticated callers. Attackers can access a poll's urlId from public invite links to retrieve sensitive invitee information regardless of privacy settings.

Affected products

• Lukevella Rallly: before 4.15.0 (fixed in 4.15.0)

Published 2026-09-16. Last modified 2026-09-23.