CVE-2025-65021
CRITICALrallly < 4.5.4 - Authenticated Insecure Direct Object Reference via Poll Finalization
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2025-65021. PoCs published by alaeddine03.
AI-analyzed exploit summary The repository provides a detailed description of CVE-2025-65021, an Insecure Direct Object Reference (IDOR) vulnerability in Rallly's poll finalization feature. It explains how authenticated users can manipulate the pollId parameter to finalize polls they do not own, leading to unauthorized data modification.
Description
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object Reference (IDOR) vulnerability exists in the poll finalization feature of the application. Any authenticated user can finalize a poll they do not own by manipulating the pollId parameter in the request. This allows unauthorized users to finalize other users’ polls and convert them into events without proper authorization checks, potentially disrupting user workflows and causing data integrity and availability issues. This issue has been patched in version 4.5.4.
Exploits (1)
The repository provides a detailed description of CVE-2025-65021, an Insecure Direct Object Reference (IDOR) vulnerability in Rallly's poll finalization feature. It explains how authenticated users can manipulate the pollId parameter to finalize polls they do not own, leading to unauthorized data modification.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H