In Bitpoll through 0.11.0, an insecure direct object reference flaw permits any unauthenticated user to read vote counts and comment content from polls that are not publicly accessible. By manipulating query parameters that reference vote or comment identifiers, an attacker can pair a known public poll slug with sequential numeric IDs to retrieve participant names and comments. This vulnerability is classified as CWE‑639 and results in unauthorized disclosure of potentially sensitive user information.

Vulnerable installations include Bitpoll version 0.11.0 or earlier. The flaw exists in the poll/views.py file that processes vote, vote_delete, vote_assign, and delete_comment GET requests without performing proper scoping checks. Any deployer running the 0.11.0 release is exposed unless the application code has been patched to enforce object ownership or request authentication.

The CVSS score of 6.9 indicates moderate severity. Because the flaw is accessible over HTTPS without authentication and requires only knowledge of a poll slug, the EPSS score is not available but the risk of exploitation remains significant in environments with public or low‑entropy slugs. The vulnerability is currently not listed in the CISA KEV catalog. Attackers can exploit the weakness simply by sending crafted GET requests to the affected endpoints, so any exposure of public slugs widens the attack surface.