PT-2025-47508 · Rallly · Rallly

Published 2025-11-19 · Updated 2025-11-25 · CVE-2025-65031

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Rallly versions prior to 4.5.4

Description Rallly, an open-source scheduling and collaboration tool, contains a flaw in authorization related to comment creation. An authenticated user can impersonate any other user by modifying the authorName field within an API request. This allows attackers to post comments attributed to arbitrary usernames, including those with administrative privileges, potentially leading to phishing or social engineering attacks. The vulnerable endpoint is the comment creation API.

Recommendations Update to version 4.5.4 or later.

Exploit

Fix

Improper Authorization

IDOR

Weakness Enumeration

CWE-285

CWE-639

Related Identifiers

CVE-2025-65031

GHSA-HHFC-6GQ7-RRPM

Affected Products

Rallly

References · 9

• 🔥 https://github.com/lukevella/rallly/security/advisories/GHSA-hhfc-6gq7-rrpm · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65031.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-65031 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65031 · Security Note
• https://github.com/lukevella/rallly/releases/tag/v4.5.4 · Note
• https://t.me/cveNotify/143957 · Telegram Post
• https://t.me/CVEtracker/37759 · Telegram Post
• https://twitter.com/CVEnew/status/1991409481457020964 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1991263600980169030 · Twitter Post