CVE-2025-65029
📋 TL;DR
This CVE describes an insecure direct object reference (IDOR) vulnerability in Rallly, an open-source scheduling tool. Any authenticated user can delete arbitrary participants from polls without ownership verification, potentially removing poll owners and disrupting collaboration. All Rallly instances running versions before 4.5.4 are affected.
💻 Affected Systems
- Rallly
📦 What is this software?
Rallly by Rallly
⚠️ Risk & Real-World Impact
Worst Case
Attackers could systematically delete all participants from critical polls, including poll owners, completely disrupting scheduling operations and causing data loss.
Likely Case
Malicious or disgruntled users deleting participants from polls they shouldn't have access to, causing confusion and disrupting scheduling workflows.
If Mitigated
With proper access controls, only poll owners and authorized users can manage participants, maintaining data integrity.
🎯 Exploit Status
Exploitation requires authenticated access but is trivial once authenticated. Attackers only need to guess or enumerate participant IDs.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.5.4
Vendor Advisory: https://github.com/lukevella/rallly/security/advisories/GHSA-f8jc-6746-ww95
Restart Required: Yes
Instructions:
1. Backup your Rallly instance and database
2. Update to version 4.5.4 or later using your deployment method (Docker, manual, etc.)
3. Restart the Rallly service
4. Verify the update was successful
🔧 Temporary Workarounds
Temporary Access Restriction
allImplement network-level restrictions to limit access to the deletion endpoint
🧯 If You Can't Patch
- Implement application-level authorization checks for all participant deletion requests
- Monitor and alert on suspicious deletion patterns in application logs
🔍 How to Verify
Check if Vulnerable:
Check if your Rallly version is below 4.5.4. Test authenticated deletion of participants from polls you don't own.Check Version:
Check Rallly web interface or deployment configuration for version numberVerify Fix Applied:
After updating to 4.5.4+, verify that authenticated users can only delete participants from polls they own or are authorized to manage.📡 Detection & Monitoring
Log Indicators:
- Multiple DELETE requests to participant endpoints from single user
- Failed authorization attempts for participant deletion
- Deletion of participants from polls not owned by the requesting user
Network Indicators:
- Unusual patterns of DELETE requests to /api/participants/* endpoints
SIEM Query:
source="rallly" AND (method="DELETE" AND uri_path="/api/participants/*") | stats count by user_id, uri_path