PT-2025-47511 · Rallly · Rallly

Published 2025-11-19 · Updated 2025-11-24 · CVE-2025-65034

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rallly versions prior to 4.5.4

Description An authorization issue exists in Rallly, a scheduling and collaboration tool. An authenticated user can manipulate the pollId parameter to reopen finalized polls owned by other users. This can disrupt event management and compromise the availability and integrity of poll data.

Recommendations Update to version 4.5.4 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-65034

GHSA-5FP2-PV2J-RQPC

Affected Products

Rallly

References · 10

• 🔥 https://github.com/lukevella/rallly/security/advisories/GHSA-5fp2-pv2j-rqpc · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65034.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-65034 · Security Note
• https://osv.dev/vulnerability/CVE-2025-65034 · Vendor Advisory
• https://github.com/lukevella/rallly/releases/tag/v4.5.4 · Note
• https://twitter.com/CVEnew/status/1991409477917007908 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1991250801688186882 · Twitter Post
• https://twitter.com/gothburz/status/1991635309075849311 · Twitter Post
• https://t.me/cveNotify/143854 · Telegram Post
• https://t.me/CVEtracker/37762 · Telegram Post