CVE-2025-65034
Rallly Improper Authorization Allows Reopening of Any Finalized Poll via Public pollId
Vexday Risk Score
21Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 8.1EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
19 nov 2025Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an improper authorization vulnerability allows any authenticated user to reopen finalized polls belonging to other users by manipulating the pollId parameter. This can disrupt events managed by other users and compromise both availability and integrity of poll data. This issue has been patched in version 4.5.4.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Productos afectados
lukevella · rallly¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →