by Kastro
Paper/Archive/CVE-2025-65021

CVE-2025-65021

lukevella rallly — Rallly Has Unauthorized Poll Finalization via Insecure Direct Object Reference (IDOR)

EPSS 0.4%public exploitCVSS 9.1
critical.is priorityof 100
44
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 35.3.353 × 207.1Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object Reference (IDOR) vulnerability exists in the poll finalization feature of the application. Any authenticated user can finalize a poll they do not own by manipulating the pollId parameter in the request. This allows unauthorized users to finalize other users’ polls and convert them into events without proper authorization checks, potentially disrupting user workflows and causing data integrity and availability issues. This issue has been patched in version 4.5.4.

Affected

ProductAffectedFixed inSource
rallly< 4.5.4–CNA

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

refgithub.com/lukevella/rallly/security/advisories/GHSA-x7w2-g548-4qg8refgithub.com/lukevella/rallly/releases/tag/v4.5.4