Improper Authorization in Rallly Scheduling Tool
CVE-2025-65034

8.1HIGH

Key Information:

Vendor

Lukevella

Status
Rallly
Vendor
CVE Published:
19 November 2025

What is CVE-2025-65034?

Rallly, an open-source scheduling and collaboration tool, is affected by an improper authorization vulnerability present in versions prior to 4.5.4. This flaw allows authenticated users to manipulate the pollId parameter, enabling them to reopen finalized polls belonging to other users. Such actions can significantly disrupt events and compromise the integrity and availability of poll-related data. A patch addressing this vulnerability was released in version 4.5.4, enhancing the security posture of Rallly users.

Affected Version(s)

rallly < 4.5.4

References

https://github.com/lukevella/rallly/security/advisories/G...
x_refsource_CONFIRM
https://github.com/lukevella/rallly/releases/tag/v4.5.4
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.