MEDIUMCVSS v3.1 5.3Vulnerability
CVE-2026-125369
Bitpoll through 0.11.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read votes and comments from other polls via unscoped object lookups in views.py. Attackers can pair any public poll slug with sequential vote or comment IDs in vote, vote_delete, vote_assign, or delete_comment GET requests to read names and comments from restricted polls.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-11-10T23:33:48.924589+00:00
- Epss score
- 0.003
- Cvss score
- 5.3
- Cvss severity
- MEDIUM
- Retrieved at
- 2026-11-10T23:35:17+00:00
- Score
- 5.3
- Last source
- FIRST EPSS
- Cvss version
- 3.1
- Cve id
- CVE-2026-125369
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- First seen by Signal
- 2026-11-10T03:20:43+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Published at
- 2026-11-10T00:17:09.073
- Last modified
- 2026-11-10T00:17:09.073
- Epss percentile
- 0.22991
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph