PT-2025-47505 · Rallly · Rallly

Published 2025-11-19 · Updated 2025-11-25 · CVE-2025-65028

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Rallly versions prior to 4.5.4

Description Rallly, an open-source scheduling and collaboration tool, contains a flaw where an authenticated user can change votes in polls belonging to other participants without proper authorization. The backend system uses the participantId parameter to identify votes for updates, but it does not confirm ownership or poll permissions. This allows an attacker to manipulate poll results. The API endpoint responsible for updating votes relies on the participantId parameter.

Recommendations Update to version 4.5.4 or later.

Exploit

Fix

Improper Authorization

IDOR

Missing Authorization

Weakness Enumeration

CWE-285

CWE-639

CWE-862

Related Identifiers

CVE-2025-65028

GHSA-PCHC-V5HG-F5GP

Affected Products

Rallly

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65028.json · Exploit
• https://github.com/lukevella/rallly/security/advisories/GHSA-pchc-v5hg-f5gp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-65028 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65028 · Security Note
• https://github.com/lukevella/rallly/releases/tag/v4.5.4 · Note
• https://t.me/cveNotify/143954 · Telegram Post
• https://twitter.com/CVEnew/status/1991409486087471435 · Twitter Post
• https://t.me/CVEtracker/37754 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1991261040999309686 · Twitter Post