CVE-2025-65029
BaseFortify
Publication date: 2025-11-19
Last updated on: 2025-11-25
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| rallly | rallly | to 4.5.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an insecure direct object reference (IDOR) in Rallly, an open-source scheduling and collaboration tool. Before version 4.5.4, any authenticated user could delete participants from polls by using only the participant ID, without verifying if they owned the poll. This means attackers can remove other users, including poll owners, from polls they do not own.
How can this vulnerability impact me? :
The vulnerability can impact you by allowing unauthorized users to delete participants from polls, which compromises the integrity and availability of poll participation data. This could disrupt collaboration and scheduling activities, potentially causing loss of important participation information.
What immediate steps should I take to mitigate this vulnerability?
Upgrade Rallly to version 4.5.4 or later, where the insecure direct object reference (IDOR) vulnerability has been patched. Until the upgrade is applied, restrict authenticated user permissions to limit the ability to delete participants from polls, and monitor poll participant deletions closely to detect any unauthorized activity.