CVE-2025-65032

Rallly prior to version 4.5.4 has an IDOR vulnerability in the poll finalization feature. Any authenticated user can finalize a poll they do not own by manipulating the pollId parameter, allowing unauthorized finalization and conversion to events.

An information disclosure vulnerability in Rallly before 4.15.0 in the polls.get tRPC procedure returns scheduled-event invitee names and email addresses to unauthenticated callers. Attackers can access a poll's urlId from public invite links to retrieve sensitive invitee information regardless of privacy settings.

A flaw has been found in lukevella rallly up to 4.7.4. It affects an unknown function in apps/web/src/app/[locale]/(auth)/reset-password/components/reset-password-form.tsx within the Reset Password Handler component. Manipulation of the redirectTo argument can lead to cross site scripting, and the attack can be executed remotely.

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.6, an information disclosure vulnerability exposes participant details, including names and email addresses through the /api/trpc/polls.get,polls.participants.list endpoint, even when Pro privacy features are enabled. This bypasses intended privacy controls that should prevent participants from viewing other users' personal information. This issue has been patched in version 4.5.6.

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an improper authorization vulnerability allows any authenticated user to reopen finalized polls belonging to other users by manipulating the pollId parameter.

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an authorization flaw in the poll management feature allows any authenticated user to pause or resume any poll, regardless of ownership, because the system identifies polls only by the public pollId.

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an improper authorization flaw in the comment creation endpoint allows authenticated users to impersonate any other user by altering the authorName field in the API request.

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an authorization flaw in the comment deletion API allows any authenticated user to delete comments belonging to other users, including poll owners and administrators.

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an insecure direct object reference (IDOR) vulnerability allows any authenticated user to delete arbitrary participants from polls without ownership verification, relying solely on a participant ID.

Rallly prior to version 4.5.4 has an insecure direct object reference (IDOR) vulnerability that allows any authenticated user to modify other participants' votes in polls without authorization. The backend relies solely on the participantId parameter without verifying ownership or poll permissions.