Improper Authorization Flaw in Rallly Affects User Impersonation
CVE-2025-65031

6.5MEDIUM

Key Information:

Vendor

Lukevella

Status
Rallly
Vendor
CVE Published:
19 November 2025

What is CVE-2025-65031?

Rallly, an open-source scheduling and collaboration tool, is impacted by an improper authorization vulnerability prior to version 4.5.4. This flaw exists in the comment creation endpoint, where authenticated users can manipulate the authorName field in API requests. As a result, attackers can impersonate any user, including those with privileged access like administrators. This creates opportunities for misleading comments, increasing the risk of phishing and social engineering attacks among users. The issue was resolved in the release of version 4.5.4.

Affected Version(s)

rallly < 4.5.4

References

https://github.com/lukevella/rallly/security/advisories/G...
x_refsource_CONFIRM
https://github.com/lukevella/rallly/releases/tag/v4.5.4
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.