Rallly EUVD-2026-80811

Exploitation requires only that the attacker possess a valid poll urlId, which is exposed in the public invite links Rallly generates and shares; no authentication, user interaction, or non-default configuration is needed (unauthenticated remote call to the polls.get tRPC procedure in Rallly before 4.15.0). The disclosure occurs regardless of the poll's privacy settings, so privacy configuration does NOT limit it. The practical limiting factors are narrow: the attacker must know or guess/obtain a specific poll's urlId, only invitees with 'accepted' or 'tentative' status are returned, and the exposed data is limited to names and email addresses (no credentials or account takeover).

This is a genuine but modest-severity information disclosure issue, and the signals are internally consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) correctly captures a remote, unauthenticated, low-complexity flaw with limited-confidentiality-only impact and no integrity or availability effect. The source-code diff from PR #3247 independently confirms the root cause: the polls.get tRPC procedure selected invites.inviteeName/inviteeEmail and returned them as an 'attendees' array in the public poll payload, exposing accepted/tentative invitee PII to any caller holding the poll's urlId. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so this is not confirmed actively exploited - no public exploit identified at time of analysis. The realistic risk is targeted PII harvesting rather than mass exploitation: an attacker must possess or discover a valid urlId (obtainable from shared/public invite links), and the payoff is names and emails, not credentials or code execution. Net: a legitimate privacy fix worth prioritizing for deployments handling sensitive invitee lists, but not an emergency relative to RCE- or auth-bypass-class issues.

An attacker obtains a Rallly poll's urlId from a publicly shared or forwarded invite link, then calls the unauthenticated polls.get tRPC procedure for that poll. The response includes the scheduled event's attendee array containing invitee names and email addresses, regardless of the poll's privacy settings, letting the attacker harvest PII for phishing or targeting. No public exploit code is identified, but the attack is trivial (AV:N/AC:L/PR:N) and requires only a normal API request.