In Vanilla before 2.6.1, the polling functionality allows Insecure Direct Object Reference (IDOR) via the Poll ID, leading to the ability of a single user to select multiple Poll Options (e.g., vote for multiple items).
https://twitter.com/viperbluff/status/1033640333890834433
https://twitter.com/viperbluff/status/1033067882941304832
https://hackerone.com/reports/326434
https://open.vanillaforums.com/discussion/36559
Source: Mitre, NVD
Published: 2018-08-26
Updated: 2026-06-17
Base Score: 4
Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:P/A:N
Severity: Medium
Base Score: 4.3
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
EPSS: 0.00198