CVE-2025-65032

Katalog CVE

CVSS 6.5 · Medium EPSS 0,26%

Kerentanan Authorization Bypass Through User-Controlled Key pada rallly. Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object Reference (IDOR) vulnerability allows any authenticated user to change the display names of other participants in polls without being an admin or the poll owner. By manipulating the participantId parameter in a rename request, an attacker can modify another user’s name, violating data integrity and potentially causing confusion or impersonation attacks. This issue has been patched in version 4.5.4.

Rincian

Terbit di NVD

19 November 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,26% peluang dieksploitasi; lebih tinggi dari 16,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/lukevella/rallly/security/advisories/GHSA-q9m7-chfx-43xw exploit · advisory vendor
• https://github.com/lukevella/rallly/releases/tag/v4.5.4 release notes