Authorization Flaw in Rallly Scheduling Tool Affects User Comments

CVE-2025-65030

What is CVE-2025-65030?

Rallly, an open-source scheduling and collaboration tool, contains an authorization flaw in its comment deletion API prior to version 4.5.4. This vulnerability allows any authenticated user to delete comments belonging to other users, including those made by poll owners and administrators. The flaw arises from the system's reliance on the comment ID for deletion, without verifying whether the user requesting the action owns the comment or possesses the necessary permissions. This issue has been addressed in the updated version 4.5.4, which implements necessary security checks.

References