IDOR Vulnerability in Rallly Scheduling Tool Affects Vote Integrity
CVE-2025-65028

6.5MEDIUM

Key Information:

Vendor

Lukevella

Status
Rallly
Vendor
CVE Published:
19 November 2025

What is CVE-2025-65028?

Rallly, an open-source scheduling and collaboration tool, experienced a vulnerability that allows authenticated users to modify other participants’ votes in polls without proper authorization. This insecure direct object reference (IDOR) issue occurs because the backend relies solely on the participantId parameter to determine which votes to change, lacking adequate ownership verification or poll permissions. As a result, attackers could manipulate poll outcomes, thus compromising the data integrity of the application. To address this issue, a patch was introduced in version 4.5.4.

Affected Version(s)

rallly < 4.5.4

References

https://github.com/lukevella/rallly/security/advisories/G...
x_refsource_CONFIRM
https://github.com/lukevella/rallly/releases/tag/v4.5.4
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-65028 : IDOR Vulnerability in Rallly Scheduling Tool Affects Vote Integrity