CVE-2025-65034
Rallly Improper Authorization Allows Reopening of Any Finalized Poll via Public pollId
- State
- Published
- Severity
- 8.1 High
- Published
- Nov 19, 2025
- Updated
- Nov 19, 2025
- Reserved
- Nov 13, 2025
Description
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an improper authorization vulnerability allows any authenticated user to reopen finalized polls belonging to other users by manipulating the pollId parameter. This can disrupt events managed by other users and compromise both availability and integrity of poll data. This issue has been patched in version 4.5.4.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.1 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H | GitHub_M |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
ralllylukevella |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.