Riskcovery

CVE-2025-65033

Rallly Broken Authorization: Any User Can Pause or Resume Any Poll via Poll ID Manipulation

State
Published
Severity
8.1 High
Published
Nov 19, 2025
Updated
Nov 19, 2025
Reserved
Nov 13, 2025

Read the record on cve.org

Description

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an authorization flaw in the poll management feature allows any authenticated user to pause or resume any poll, regardless of ownership. The system only uses the public pollId to identify polls, and it does not verify whether the user performing the action is the poll owner. As a result, any user can disrupt polls created by others, leading to a loss of integrity and availability across the application. This issue has been patched in version 4.5.4.

Scores

CVSSScoreVectorSource
3.18.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HGitHub_M

Weaknesses

  • CWE-285 Improper Authorization
  • CWE-639 Authorization Bypass Through User-Controlled Key

Affected Products

ProductVersions
ralllylukevella
  • < 4.5.4Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.