External risk intelligence

Rallly IDOR vulnerability allows unauthorized poll finalization.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2025-65021

Rallly is a web-based scheduling and collaboration tool designed to be accessible to users over the internet. As a web application, it is commonly deployed as an internet-facing service to facilitate scheduling and collaboration, making the application's features, including poll management, typically reachable from the public internet.

Rallly

before 4.5.4

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in the Rallly scheduling tool allows any authenticated user to finalize polls they don't own, potentially disrupting workflows and impacting data integrity. This issue affects versions prior to 4.5.4 and has been addressed in the latest release. The main concern is confirming relevance and exposure.

Unauthorized users can alter shared polls.
Critical flaw could disrupt collaboration and data.
Confirm if Rallly is used and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker can take over another user's poll and turn it into an event. This is possible if the attacker can trick a user into clicking a link. The attacker manipulates a poll ID in the request to finalize a poll they don't own. This could disrupt workflows and damage data.

Requires authenticated user access.
Manipulates poll ID parameter.
Unauthorized poll finalization and event creation.

Live Threat

Current exploitation, exposure, and threat context

Authenticated users could finalize polls they do not own by manipulating a request parameter. This could lead to unauthorized conversion of polls into events, potentially impacting data integrity and availability within the Rallly application.

Poll data integrity and availability at risk.
Manipulating poll ID parameter.
Unauthorized event creation.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Rallly application owner or the platform team managing its deployment is likely responsible for addressing this vulnerability. The first practical step is to identify all Rallly instances, confirm their exposure and criticality, and then coordinate remediation with the appropriate teams, potentially including vendor coordination if it's a SaaS offering.

Identify and confirm Rallly instances.
Verify poll finalization feature exposure.
Plan event disruption mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Rallly?

Rallly is an open-source web application designed to simplify group scheduling and collaboration. Users typically deploy it to coordinate meetings or events by creating polls that others can vote on. Because it is built for remote coordination, it is frequently configured as a web-accessible service, allowing teams or groups to interact with shared scheduling boards through a browser.

What is the CVE-2025-65021 vulnerability?

This vulnerability is an Insecure Direct Object Reference, or IDOR. It occurs when an application fails to properly verify if a user has permission to access or modify a specific data object. In this case, the software does not check ownership before allowing a user to finalize a poll, which is a flaw categorized under improper authorization.

How does an attacker trigger this flaw?

An attacker exploits this by manipulating the pollId parameter in a request sent to the application. To succeed, the attacker must already be an authenticated user of the system. Importantly, the bug is not triggered by public, unauthenticated access; it requires the attacker to have a valid user session, which they then use to target and finalize a poll they do not own.

Is my Rallly instance at risk?

According to Halo Surface Signal, Rallly is commonly deployed as an internet-facing service to enable broad collaboration, which increases the likelihood that your instance is reachable by external users. If your instance is accessible over the internet, it is more exposed to unauthorized interactions compared to a strictly internal, private deployment.

How do I address this issue?

You should update your Rallly installation to version 4.5.4 or later, as this release contains the necessary authorization checks to prevent unauthorized poll finalization. Start by identifying all active instances in your environment, then coordinate with your platform or maintenance teams to apply the patch and verify that the fix is properly implemented.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.