CVE-2025-65028
MEDIUMrallly < 4.5.4 - Authenticated Insecure Direct Object Reference via ParticipantId Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2025-65028. PoCs published by alaeddine03.
AI-analyzed exploit summary The repository provides a detailed description of an Insecure Direct Object Reference (IDOR) vulnerability in Rallly, allowing authenticated users to modify other participants' votes without proper authorization. The issue was patched in version 4.5.4.
Description
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an insecure direct object reference (IDOR) vulnerability allows any authenticated user to modify other participants’ votes in polls without authorization. The backend relies solely on the participantId parameter to identify which votes to update, without verifying ownership or poll permissions. This allows an attacker to alter poll results in their favor, directly compromising data integrity. This issue has been patched in version 4.5.4.
Exploits (1)
The repository provides a detailed description of an Insecure Direct Object Reference (IDOR) vulnerability in Rallly, allowing authenticated users to modify other participants' votes without proper authorization. The issue was patched in version 4.5.4.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N