---
id: "CVE-2026-125369"
page: "https://infrastack.ai/live/CVE-2026-125369"
kind: "vulnerability"
aliases: ["CVE-2026-125369"]
title: "Bitpoll: unscoped lookups let anonymous visitors read other polls' votes"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["bitpoll", "package", "python", "self-hosted"]
not_affected_if: ["public-polls-only"]
published_at: "2026-11-10T00:17:09+00:00"
first_seen_at: "2026-11-10T00:28:42+00:00"
updated_at: "2026-11-10T00:30:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125369", "first_seen_at": "2026-11-10T00:28:42+00:00"}]
exploit_sources: []
---

# Bitpoll: unscoped lookups let anonymous visitors read other polls' votes

Link for people: https://infrastack.ai/live/CVE-2026-125369 (this .md is for agents)

Bitpoll through 0.11.0 looks up votes and comments by sequential ID without checking which poll they belong to. An unauthenticated attacker can pair any public poll slug with those IDs and read names and comments from restricted polls.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Bitpoll version against the affected range (through `0.11.0`).
- Review `views.py` for vote and comment lookups that are not filtered by poll.

## Timeline

- 2026-11-10T00:28:42+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125369

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/bitpoll-through-0.11.0-unauthenticated-vote-and-comment-disclosure-via-unscoped-lookups
- [fix] Patch: github.com https://github.com/fsinfuhh/Bitpoll/commit/71013d36a4d587e672eba225d94f7b94cd412ef9

## From the sources

Bitpoll through 0.11.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read votes and comments from other polls via unscoped object lookups in views.py. Attackers can pair any public poll slug with sequential vote or comment IDs in vote, vote_delete, vote_assign, or delete_comment GET requests to read names and comments from restricted polls.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_