PT-2025-47506 · Rallly · Rallly

Published 2025-11-19 · Updated 2025-11-25 · CVE-2025-65029

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rallly versions prior to 4.5.4

Description An insecure direct object reference (IDOR) issue exists in Rallly, allowing authenticated users to delete arbitrary participants from polls without proper ownership verification. The issue stems from the application relying solely on a participant ID to authorize deletions. This allows attackers to remove other users, including poll owners, from polls, impacting data integrity and availability. The vulnerable API endpoint allows deletion of participants based on the participant ID.

Recommendations Update to version 4.5.4 or later.

Exploit

Fix

Improper Authorization

IDOR

Missing Authorization

Weakness Enumeration

CWE-285

CWE-639

CWE-862

Related Identifiers

CVE-2025-65029

GHSA-F8JC-6746-WW95

Affected Products

Rallly

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65029.json · Exploit
• https://github.com/lukevella/rallly/security/advisories/GHSA-f8jc-6746-ww95 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65029 · Security Note
• https://osv.dev/vulnerability/CVE-2025-65029 · Vendor Advisory
• https://github.com/lukevella/rallly/releases/tag/v4.5.4 · Note
• https://t.me/cveNotify/143955 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1991253361690018232 · Twitter Post
• https://twitter.com/gothburz/status/1991628026463895783 · Twitter Post
• https://t.me/CVEtracker/37757 · Telegram Post
• https://twitter.com/CVEnew/status/1991409483306709228 · Twitter Post