CVE-2025-65030
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-19

Last updated on: 2025-11-25

Assigner: GitHub, Inc.

Description
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an authorization flaw in the comment deletion API allows any authenticated user to delete comments belonging to other users, including poll owners and administrators. The endpoint relies solely on the comment ID for deletion and does not validate whether the requesting user owns the comment or has permission to remove it. This issue has been patched in version 4.5.4.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-19
Last Modified
2025-11-25
Generated
2026-06-16
AI Q&A
2025-11-19
EPSS Evaluated
2026-06-15
NVD
CVE-2025-65030
EUVD
EUVD-2025-198235
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
rallly rallly to 4.5.4 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is an authorization flaw in Rallly's comment deletion API prior to version 4.5.4. It allows any authenticated user to delete comments made by other users, including those by poll owners and administrators, because the API only checks the comment ID and does not verify if the user has permission to delete that comment.

Impact Analysis

The vulnerability can lead to unauthorized deletion of comments by users who should not have permission, potentially disrupting collaboration, deleting important information, and undermining trust in the platform's integrity and security.

Mitigation Strategies

Upgrade Rallly to version 4.5.4 or later, as this version contains the patch that fixes the authorization flaw in the comment deletion API.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-65030. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart