High · published November 19, 2025
⚡ An authenticated user could easily delete other participants from polls, and it's all because the system trusts a participant ID without checking ownership! 🚨 Think of it like a restaurant where any diner can remove other guests from a reservation list just by knowing their name — chaotic and unfair! If this vulnerability is exploited, an attacker could remove key participants, including poll owners, from important discussions. This could lead to disastrous decisions and a complete breakdown of trust in the scheduling tool, leaving a lot of confusion and frustration in its wake!
Think of it like a restaurant where any diner can remove other guests from a reservation list just by knowing their name — chaotic and unfair! This insecure direct object reference (IDOR) vulnerability allows authenticated users to delete arbitrary participants from polls by solely relying on participant IDs for authorization, without verifying if the user has ownership over those IDs.
If this vulnerability is exploited, an attacker could remove key participants, including poll owners, from important discussions. This could lead to disastrous decisions and a complete breakdown of trust in the scheduling tool, leaving a lot of confusion and frustration in its wake! To secure your application, upgrade Rallly to version 4.5.4 immediately. Additionally, review your access controls to ensure that sensitive actions like deletions require proper ownership verification. Remember to audit permissions regularly! You've totally got this! Just follow the steps and your polls will be safe in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| rallly/rallly | < 4.5.4 | 4.5.4 |