CVEvulnerability

CVE-2025-65029

8.1 HIGH Published 2025-11-19 Modified 2026-10-18 Official page ↗
Status
Analyzed
Published
2025-11-19
Last modified
2026-10-18
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Weaknesses
CWE-285, CWE-639, CWE-862

Description

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an insecure direct object reference (IDOR) vulnerability allows any authenticated user to delete arbitrary participants from polls without ownership verification. The endpoint relies solely on a participant ID to authorize deletions, enabling attackers to remove other users (including poll owners) from polls. This impacts the integrity and availability of poll participation data. This issue has been patched in version 4.5.4.

Affected configurations

• rallly rallly (< 4.5.4)

Related

Weakness · CWE (3)

  • CWE-285 Improper Authorization weakness
  • CWE-639 Authorization Bypass Through User-Controlled Key weakness
  • CWE-862 Missing Authorization weakness

References