CVEvulnerability

CVE-2025-65020

6.5 MEDIUM Published 2025-11-19 Modified 2026-10-18 Official page ↗
Status
Analyzed
Published
2025-11-19
Last modified
2026-10-18
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-285, CWE-639, CWE-862

Description

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object Reference (IDOR) vulnerability in the poll duplication endpoint (/api/trpc/polls.duplicate) allows any authenticated user to duplicate polls they do not own by modifying the pollId parameter. This effectively bypasses access control and lets unauthorized users clone private or administrative polls. This issue has been patched in version 4.5.4.

Affected configurations

• rallly rallly (< 4.5.4)

Related

Weakness · CWE (3)

  • CWE-285 Improper Authorization weakness
  • CWE-639 Authorization Bypass Through User-Controlled Key weakness
  • CWE-862 Missing Authorization weakness

References