CVE-2025-65020 MEDIUM

CVE-2025-65020: Rallly Has Unauthorized Poll Duplication via Insecure Direct Object Reference (IDOR)

Vendor Lukevella
Product rallly
Weakness CWE-285
Published November 19, 2025
Last update November 19, 2025
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object Reference (IDOR) vulnerability in the poll duplication endpoint (/api/trpc/polls.duplicate) allows any authenticated user to duplicate polls they do not own by modifying the pollId parameter. This effectively bypasses access control and lets unauthorized users clone private or administrative polls. This issue has been patched in version 4.5.4.

Key dates

02Disclosure timeline

November 19, 2025 CVE published
November 19, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-21400 Microsoft SharePoint Server Remote Code Execution Vulnerability CVE-2024-56320 GoCD vulnerable to admin privilege escalation by a malicious internal/existing authenticated user CVE-2026-42202 nova-toggle-5: Improper authorization on toggle endpoint allowed non-Nova users to modify boolean fields CVE-2025-4104 Frontend Dashboard 1.0 - 2.2.6 - Missing Authorization to Unauthenticated Privilege Escalation via fed_wp_ajax_fed_login_form_post Function CVE-2022-39862