Insecure Direct Object Reference in Rallly Scheduling Tool
CVE-2025-65032

6.5MEDIUM

Key Information:

Vendor

Lukevella

Status
Rallly
Vendor
CVE Published:
19 November 2025

What is CVE-2025-65032?

Rallly, an open-source scheduling and collaboration tool, harbors an Insecure Direct Object Reference (IDOR) vulnerability that impacts user data integrity. Prior to version 4.5.4, any authenticated user could exploit this vulnerability to alter the display names of other participants in polls without possessing administrative privileges or being the poll owner. This exploitation occurs by manipulating the 'participantId' parameter in name modification requests, leading to potential impersonation attacks and confusion amongst users. The issue has since been remediated in version 4.5.4, ensuring a more robust security posture.

Affected Version(s)

rallly < 4.5.4

References

https://github.com/lukevella/rallly/security/advisories/G...
x_refsource_CONFIRM
https://github.com/lukevella/rallly/releases/tag/v4.5.4
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-65032 : Insecure Direct Object Reference in Rallly Scheduling Tool