PT-2025-47501 · Rallly · Rallly

Published 2025-11-19 · Updated 2025-11-25 · CVE-2025-65020

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Rallly versions prior to 4.5.4

Description Rallly is a scheduling and collaboration tool. An Insecure Direct Object Reference (IDOR) exists in the poll duplication endpoint /api/trpc/polls.duplicate. An authenticated user can bypass access controls by modifying the pollId parameter and duplicate polls they do not own. This allows unauthorized cloning of private or administrative polls.

Recommendations Update to version 4.5.4 or later.

Exploit

Fix

Improper Authorization

IDOR

Missing Authorization

Weakness Enumeration

CWE-285

CWE-639

CWE-862

Related Identifiers

CVE-2025-65020

GHSA-44W7-PF32-GV5M

Affected Products

Rallly

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65020.json · Exploit
• https://github.com/lukevella/rallly/security/advisories/GHSA-44w7-pf32-gv5m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-65020 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65020 · Security Note
• https://github.com/lukevella/rallly/releases/tag/v4.5.4 · Note
• https://twitter.com/CVEnew/status/1991409485152186760 · Twitter Post
• https://t.me/cveNotify/143952 · Telegram Post
• https://t.me/CVEtracker/37755 · Telegram Post