Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an improper authorization vulnerability allows any authenticated user to reopen finalized polls belonging to other users by manipulating the pollId parameter. This can disrupt events managed by other users and compromise both availability and integrity of poll data. This issue has been patched in version 4.5.4.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/lukevella/rallly/security/advisories/GHSA-5fp2-pv2j-rqpc Exploit, Vendor Advisory
- https://github.com/lukevella/rallly/security/advisories/GHSA-5fp2-pv2j-rqpc Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 8.1 · ralllyNVD modified 2026-10-18 20:10
Affected (CPE criteria) 1
cpe:2.3:a:rallly:rallly:*:*:*:*:*:*:*:*
References 3
- https://github.com/lukevella/rallly/releases/tag/v4.5.4 Release Notes
- https://github.com/lukevella/rallly/security/advisories/GHSA-5fp2-pv2j-rqpc Exploit, Vendor Advisory
- https://github.com/lukevella/rallly/security/advisories/GHSA-5fp2-pv2j-rqpc Exploit, Vendor Advisory