CVE-2026-92565 lukevella CVE debrief

Who should care

Defenders responsible for Rallly instances, particularly those using versions before 4.15.0, should assess exposure and prioritize upgrading to mitigate this vulnerability. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify exposure, review compensating controls, and plan for upgrades or mitigations.

Why it matters

CVE-2026-92565 is a medium-severity information disclosure vulnerability in Rallly before version 4.15.0. Defenders should prioritize verifying exposure and upgrading to mitigate potential unauthorized access to sensitive invitee information.

• Potential unauthorized access to sensitive invitee information
• Possible exploitation via public invite links
• Need for verification of Rallly instance version and exposure
• Priority on upgrading to version 4.15.0 or later

Technical summary

The polls.get tRPC procedure in Rallly before version 4.15.0 returns scheduled-event invitee names and email addresses to unauthenticated callers. This allows attackers to access sensitive invitee information by exploiting public invite links, regardless of privacy settings. The vulnerability exists in Rallly before version 4.15.0 and can be exploited by accessing a poll's urlId from public invite links to retrieve sensitive invitee information. Defenders should prioritize verifying exposure of Rallly instances to this vulnerability and upgrading to version 4.15.0 or later.

Defensive priority

Defenders should prioritize verifying exposure of Rallly instances to this vulnerability and upgrading to version 4.15.0 or later.

Recommended defensive actions

• Verify Rallly instance version and exposure to this vulnerability
• Upgrade to Rallly version 4.15.0 or later
• Review and adjust privacy settings for polls and invitees
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its existence in Rallly before version 4.15.0 and the potential for unauthenticated access to sensitive invitee information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.