CVE-2026-125369 Bitpoll through 0.11.0 Unauthenticated Vote and Comment Disclosure via Unscoped Lookups
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-125369?
CVE-2026-125369 is a medium-severity vulnerability in fsinfuhh Bitpoll, published on 9 Nov 2026.
Official description
Bitpoll through 0.11.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read votes and comments from other polls via unscoped object lookups in views.py. Attackers can pair any public poll slug with sequential vote or comment IDs in vote, vote_delete, vote_assign, or delete_comment GET requests to read names and comments from restricted polls.
Weakness: CWE-639
Which versions are affected by CVE-2026-125369?
How do I fix CVE-2026-125369?
No fix has been published for CVE-2026-125369 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-125369 being exploited?
There is no known exploitation of CVE-2026-125369 in the wild and no public exploit code.
Sources
Also known as GHSA-frxv-g6p8-4jv8.