CVE-2026-125369

MEDIUM 5.3

Bitpoll through 0.11.0 Unauthenticated Vote and Comment Disclosure via Unscoped Lookups

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

Bitpoll through 0.11.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read votes and comments from other polls via unscoped object lookups in views.py. Attackers can pair any public poll slug with sequential vote or comment IDs in vote, vote_delete, vote_assign, or delete_comment GET requests to read names and comments from restricted polls.

CWE	CWE-639
Vendor	fsinfuhh
Product	bitpoll
Published	Nov 9, 2026

Stay Ahead of the Next One

Get instant alerts for fsinfuhh bitpoll

Be the first to know when new medium vulnerabilities affecting fsinfuhh bitpoll are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

fsinfuhh / Bitpoll

0 ≤ 0.11.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/fsinfuhh/Bitpoll/issues/206 github.com: https://github.com/fsinfuhh/Bitpoll github.com: https://github.com/fsinfuhh/Bitpoll/blob/0.11.0/bitpoll/poll/views.py#L994 github.com: https://github.com/fsinfuhh/Bitpoll/commit/71013d36a4d587e672eba225d94f7b94cd412ef9 vulncheck.com: https://www.vulncheck.com/advisories/bitpoll-through-0.11.0-unauthenticated-vote-and-comment-disclosure-via-unscoped-lookups

Credits

George Chen