CVE-2026-125369 · Package
NO FIX YET
Bitpoll through 0.11.0 looks up votes and comments by sequential ID without checking which poll they belong to. An unauthenticated attacker can pair any public poll slug with those IDs and read names and comments from restricted polls.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run a self-hosted Bitpoll instance with restricted polls are exposed, since the flaw is in the views that serve vote, vote_delete, vote_assign and delete_comment GET requests. Instances running only public polls expose little beyond what is already public. The sources do not say whether a patched version exists.
Not affected if public-polls-only
Who cares bitpoll, python, self-hosted
0.11.0).views.py for vote and comment lookups that are not filtered by poll.No fix yet, per the sources.
Bitpoll through 0.11.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read votes and comments from other polls via unscoped object lookups in views.py. Attackers can pair any public poll slug with sequential vote or comment IDs in vote, vote_delete, vote_assign, or delete_comment GET requests to read names and comments from restricted polls.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.