CVE-2025-65034

Published: Nov 19, 2025Modified: Nov 24, 2025

8.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Exploitability: 2.8 / Impact: 5.2

Source: security-advisories@github.com (Secondary)

Description

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an improper authorization vulnerability allows any authenticated user to reopen finalized polls belonging to other users by manipulating the pollId parameter. This can disrupt events managed by other users and compromise both availability and integrity of poll data. This issue has been patched in version 4.5.4.

Affected (1)

Products: Rallly: Rallly

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Rallly Rallly	Before 4.5.4

Related CWEs

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (3)

https://github.com/lukevella/rallly/releases/tag/v4.5.4

Source: security-advisories@github.com

Release Notes

https://github.com/lukevella/rallly/security/advisories/GHSA-5fp2-pv2j-rqpc

Source: security-advisories@github.com

ExploitVendor Advisory

https://github.com/lukevella/rallly/security/advisories/GHSA-5fp2-pv2j-rqpc

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitVendor Advisory

Timeline

No history available yet.