Insecure Direct Object Reference in Bitpoll by fsinfuhh
CVE-2026-125369

6.9MEDIUM

Key Information:

Vendor

Fsinfuhh

Status
Bitpoll
Vendor
CVE Published:
9 November 2026

What is CVE-2026-125369?

Bitpoll version 0.11.0 is susceptible to an insecure direct object reference vulnerability, which enables attackers without authentication to access votes and comments associated with public polls. This vulnerability arises from unscoped object lookups in the views.py file. Attackers can exploit this flaw by pairing a public poll slug with incrementing vote or comment IDs in specific GET requests, thereby disclosing restricted information that should remain confidential.

Affected Version(s)

Bitpoll 0 <= 0.11.0

References

https://github.com/fsinfuhh/Bitpoll/issues/206
issue-tracking
https://github.com/fsinfuhh/Bitpoll
product
https://github.com/fsinfuhh/Bitpoll/blob/0.11.0/bitpoll/p...
technical-description

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.