Critical · published November 19, 2025
🚨 A crafty user can finalize any poll they don’t own with just a tweak of the pollId – talk about a recipe for chaos! 🔥 Think of it like a restaurant where anyone can grab the chef's special from the menu and change it to their liking without permission — imagine the confusion and food fights that would break out! This IDOR vulnerability allows any authenticated user to finalize other users' polls, potentially disrupting workflows and creating a data mess. Users could end up with events they didn’t create or approve, leading to absolute chaos in scheduling and collaboration efforts.
Think of it like a restaurant where anyone can grab the chef's special from the menu and change it to their liking without permission — imagine the confusion and food fights that would break out! In Rallly versions prior to 4.5.4, the poll finalization process does not verify if the authenticated user is the owner of the poll, allowing manipulation of the pollId parameter in requests to finalize anyone's poll without authorization checks.
This IDOR vulnerability allows any authenticated user to finalize other users' polls, potentially disrupting workflows and creating a data mess. Users could end up with events they didn’t create or approve, leading to absolute chaos in scheduling and collaboration efforts. Upgrade to version 4.5.4 immediately to patch this vulnerability. Additionally, review your application’s authorization checks to ensure that users can only act on their own resources. Regular audits are a great practice to maintain security! You’ve got this! Follow these steps and keep your scheduling smooth and secure. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| rallly/rallly | < 4.5.4 | 4.5.4 |