Insecure Direct Object Reference in Rallly Scheduling Tool

CVE-2025-65020

What is CVE-2025-65020?

Rallly, an open-source scheduling and collaboration tool, is susceptible to an Insecure Direct Object Reference vulnerability in its poll duplication endpoint. This flaw allows authenticated users to duplicate polls they don’t own by tampering with the pollId parameter. As a result, unauthorized users can bypass access controls, gaining access to private or administrative polls. This vulnerability was resolved in version 4.5.4, emphasizing the importance of regular updates and security assessments.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References