IDOR Vulnerability in Rallly Scheduling Tool Affects Vote Integrity

CVE-2025-65028

What is CVE-2025-65028?

Rallly, an open-source scheduling and collaboration tool, experienced a vulnerability that allows authenticated users to modify other participants’ votes in polls without proper authorization. This insecure direct object reference (IDOR) issue occurs because the backend relies solely on the participantId parameter to determine which votes to change, lacking adequate ownership verification or poll permissions. As a result, attackers could manipulate poll outcomes, thus compromising the data integrity of the application. To address this issue, a patch was introduced in version 4.5.4.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References