Information Disclosure Vulnerability in Rallly by Luke Vella

CVE-2025-66027

What is CVE-2025-66027?

Rallly, the open-source scheduling and collaboration tool, is affected by an information disclosure vulnerability that allows exposure of participant details. Before version 4.5.6, this flaw enables unauthorized access to names and email addresses through specific API endpoints, even with Pro privacy features activated. This defect undermines the intended privacy measures designed to safeguard user information, highlighting the importance of promptly updating to the patched version 4.5.6 to mitigate risks.

References