High · published November 19, 2025
⚡ Any authenticated user can delete comments they don’t own! Rallly's comment deletion API lacked proper authorization checks, making it a breeze for mischief-makers to wipe your insightful feedback clean. 🔥 This flaw is like having a restaurant where any customer can erase another diner's reviews — one bad comment gone could ruin the reputation of the whole place! In a worst-case scenario, a user could delete crucial comments from a poll, sabotaging discussions and leaving poll owners and admins in the lurch. Imagine losing valuable insights just because someone decided to play digital janitor!
This flaw is like having a restaurant where any customer can erase another diner's reviews — one bad comment gone could ruin the reputation of the whole place! This vulnerability arises from an authorization oversight in Rallly's comment deletion API, which relies solely on the comment ID without verifying the requestor's ownership or permissions. As a result, any authenticated user can remove comments from others, including those from poll creators and administrators.
In a worst-case scenario, a user could delete crucial comments from a poll, sabotaging discussions and leaving poll owners and admins in the lurch. Imagine losing valuable insights just because someone decided to play digital janitor! Upgrade to Rallly version 4.5.4 immediately to patch this vulnerability. Additionally, enhance permission checks on the comment deletion API to ensure users can only delete their own comments. Regularly audit your API permissions to prevent similar issues. You've got this! Secure your Rallly instance and protect those valuable conversations! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| rallly/rallly | < 4.5.4 | 4.5.4 |