CVEvulnerability

CVE-2025-65031

6.5 MEDIUM Published 2025-11-19 Modified 2026-10-18 Official page ↗
Status
Analyzed
Published
2025-11-19
Last modified
2026-10-18
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-285, CWE-639

Description

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an improper authorization flaw in the comment creation endpoint allows authenticated users to impersonate any other user by altering the authorName field in the API request. This enables attackers to post comments under arbitrary usernames, including privileged ones such as administrators, potentially misleading other users and enabling phishing or social engineering attacks. This issue has been patched in version 4.5.4.

Affected configurations

• rallly rallly (< 4.5.4)

Related

Weakness · CWE (2)

  • CWE-285 Improper Authorization weakness
  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References