CVE-2025-65020CWE-285CWE-639CWE-862broken-access-control

CVE-2025-65020

Medium · published November 19, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
17.0
In the wild
Unconfirmed
What it is

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object Reference (IDOR) vulnerability in the poll duplication endpoint (/api/trpc/polls.duplicate) allows any authenticated user to duplicate polls they do not own by modifying the pollId parameter. This effectively bypasses access control and lets unauthorized users clone private or administrative polls. This issue has been patched in version 4.5.4.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00261 · 17.0th percentile
Weaknesses
CWE-285 · Improper Authorization; CWE-639 · Authorization Bypass Through User-Controlled Key; CWE-862 · Missing Authorization
Published
2025-11-19T23:15Z
Affected products (1)
ProductVersionsFixed in
rallly/rallly< 4.5.44.5.4
References (2)
https://github.com/lukevella/rallly/releases/tag/v4.5.4 · [email protected]https://github.com/lukevella/rallly/security/advisories/GHSA-44w7-pf32-gv5m · [email protected]
EPSS history
Timeline
  • 19 NOV 17:24Z
    Rallly Has Unauthorized Poll Duplication via Insecure Direct Object Reference (IDOR)
    cvelistv5