PT-2025-47502 · Rallly · Rallly

Published 2025-11-19 · Updated 2025-11-25 · CVE-2025-65021

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rallly versions prior to 4.5.4

Description An Insecure Direct Object Reference (IDOR) issue exists in the poll finalization feature of Rallly. An authenticated user can finalize a poll they do not own by manipulating the pollId parameter in the request. This allows unauthorized users to finalize other users’ polls and convert them into events without authorization checks, potentially disrupting user workflows and causing data integrity and availability issues.

Recommendations Update to version 4.5.4 or later.

Exploit

Fix

Improper Authorization

IDOR

Missing Authorization

Weakness Enumeration

CWE-285

CWE-639

CWE-862

Related Identifiers

CVE-2025-65021

GHSA-X7W2-G548-4QG8

Affected Products

Rallly

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65021.json · Exploit
• https://github.com/lukevella/rallly/security/advisories/GHSA-x7w2-g548-4qg8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-65021 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65021 · Security Note
• https://github.com/lukevella/rallly/releases/tag/v4.5.4 · Note
• https://twitter.com/offseq/status/1991318585549984198 · Twitter Post
• https://t.me/CVEtracker/37756 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1991271280373363150 · Twitter Post
• https://twitter.com/CVEnew/status/1991409484233588852 · Twitter Post
• https://t.me/cveNotify/143953 · Telegram Post
• https://twitter.com/gothburz/status/1991605123060043807 · Twitter Post
• https://twitter.com/0dayPublishing/status/1991199781377417481 · Twitter Post