{"id":"CVE-2026-125369","kind":"vulnerability","aliases":["CVE-2026-125369"],"related":[],"title":"Bitpoll: unscoped lookups let anonymous visitors read other polls' votes","description":"Bitpoll through 0.11.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read votes and comments from other polls via unscoped object lookups in views.py. Attackers can pair any public poll slug with sequential vote or comment IDs in vote, vote_delete, vote_assign, or delete_comment GET requests to read names and comments from restricted polls.","summary":"Bitpoll through 0.11.0 looks up votes and comments by sequential ID without checking which poll they belong to. An unauthenticated attacker can pair any public poll slug with those IDs and read names and comments from restricted polls.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bitpoll","package","python","self-hosted"],"not_affected_if":["public-polls-only"],"how_to_check":"- Check the installed Bitpoll version against the affected range (through `0.11.0`).\n- Review `views.py` for vote and comment lookups that are not filtered by poll.","fix":null,"status":"open","published_at":"2026-11-10T00:17:09+00:00","first_seen_at":"2026-11-10T00:28:42+00:00","triaged_at":"2026-11-10T00:30:17+00:00","updated_at":"2026-11-10T00:30:17+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-10T00:30:17Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"Bitpoll: unscoped lookups let anonymous visitors read other polls' votes","impact":"medium","summary":"Bitpoll through 0.11.0 looks up votes and comments by sequential ID without checking which poll they belong to. An unauthenticated attacker can pair any public poll slug with those IDs and read names and comments from restricted polls.","audience":"businesses","category":"package","nicknames":[],"who_cares":["bitpoll","self-hosted","python"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Anonymous attackers read names and comments from restricted polls.","analyst_note":"Confirm the fixed version and whether the patch on github.com covers this CVE; the sources list no products or ranges with a fixed version.","how_to_check":"- Check the installed Bitpoll version against the affected range (through `0.11.0`).\n- Review `views.py` for vote and comment lookups that are not filtered by poll.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["public-polls-only"],"who_is_affected":"Teams that run a self-hosted Bitpoll instance with restricted polls are exposed, since the flaw is in the views that serve vote, vote_delete, vote_assign and delete_comment GET requests. Instances running only public polls expose little beyond what is already public. The sources do not say whether a patched version exists.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000741,"input_tokens":4621,"output_tokens":557,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125369':13A,16A '-2026':12A,15A '0.11.0':25B,63C 'allow':72C 'anonym':5A 'assign':107C 'attack':43B,74C,89C 'belong':39B 'bitpol':1A,17B,23B,61C 'check':35B 'comment':30B,57B,79C,100C,110C,117C 'contain':64C 'cve':11A,14A 'delet':105C,109C 'direct':67C 'get':111C 'host':22B 'id':33B,52B,101C 'insecur':66C 'let':4A 'look':26B 'lookup':3A,86C 'name':55B,115C 'object':68C,85C 'packag':18B 'pair':45B,91C 'poll':9A,37B,48B,60B,82C,94C,120C 'public':47B,93C 'python':19B 'read':7A,54B,76C,114C 'refer':69C 'request':112C 'restrict':59B,119C 'self':21B 'self-host':20B 'sequenti':32B,97C 'slug':49B,95C 'unauthent':42B,73C 'unscop':2A,84C 'via':83C 'views.py':88C 'visitor':6A 'vote':10A,28B,77C,98C,103C,104C,106C 'vulner':70C 'without':34B","nicknames":[],"mitigations":[],"who_affected":"Teams that run a self-hosted Bitpoll instance with restricted polls are exposed, since the flaw is in the views that serve vote, vote_delete, vote_assign and delete_comment GET requests. Instances running only public polls expose little beyond what is already public. The sources do not say whether a patched version exists.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bitpoll","medium","package","python","selfhosted"],"campaign_type":null,"search_a":"'-125369':13A,16A '-2026':12A,15A 'anonym':5A 'bitpol':1A 'cve':11A,14A 'let':4A 'lookup':3A 'poll':9A 'read':7A 'unscop':2A 'visitor':6A 'vote':10A","search_b":"'0.11.0':25B 'attack':43B 'belong':39B 'bitpol':17B,23B 'check':35B 'comment':30B,57B 'host':22B 'id':33B,52B 'look':26B 'name':55B 'packag':18B 'pair':45B 'poll':37B,48B,60B 'public':47B 'python':19B 'read':54B 'restrict':59B 'self':21B 'self-host':20B 'sequenti':32B 'slug':49B 'unauthent':42B 'vote':28B 'without':34B","search_c":"'0.11.0':63C 'allow':72C 'assign':107C 'attack':74C,89C 'bitpol':61C 'comment':79C,100C,110C,117C 'contain':64C 'delet':105C,109C 'direct':67C 'get':111C 'id':101C 'insecur':66C 'lookup':86C 'name':115C 'object':68C,85C 'pair':91C 'poll':82C,94C,120C 'public':93C 'read':76C,114C 'refer':69C 'request':112C 'restrict':119C 'sequenti':97C 'slug':95C 'unauthent':73C 'unscop':84C 'via':83C 'views.py':88C 'vote':77C,98C,103C,104C,106C 'vulner':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T00:17:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125369","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125369","severity":null,"published_at":"2026-11-10T00:17:09+00:00","modified_at":"2026-11-10T00:17:09+00:00","first_seen_at":"2026-11-10T00:28:42+00:00","fetched_at":"2026-11-10T00:28:42+00:00","note":null}],"documents":[{"id":111516,"url":"https://github.com/fsinfuhh/Bitpoll/commit/71013d36a4d587e672eba225d94f7b94cd412ef9","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":111517,"url":"https://www.vulncheck.com/advisories/bitpoll-through-0.11.0-unauthenticated-vote-and-comment-disclosure-via-unscoped-lookups","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}