IDOR Vulnerability in Rallly Scheduling Tool
CVE-2025-65029

8.1HIGH

Key Information:

Vendor

Lukevella

Status
Rallly
Vendor
CVE Published:
19 November 2025

What is CVE-2025-65029?

Rallly, the open-source scheduling and collaboration tool, has an insecure direct object reference issue that impacts versions prior to 4.5.4. This vulnerability allows any authenticated user to delete arbitrary participants from polls without verifying ownership, posing a risk to data integrity and availability. By simply using a participant ID, an attacker can eliminate other users, including poll owners, from polls. This loophole undermines the reliability of poll participation data, affecting users' collaborative efforts. Users are advised to upgrade to version 4.5.4 or later to secure their accounts.

Affected Version(s)

rallly < 4.5.4

References

https://github.com/lukevella/rallly/security/advisories/G...
x_refsource_CONFIRM
https://github.com/lukevella/rallly/releases/tag/v4.5.4
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-65029 : IDOR Vulnerability in Rallly Scheduling Tool