TI-2025-30246 CVE-2025-47781
Rallly Insufficient Password Login Token Entropy Leads to Account Takeover
Priority HIGH 82
Rallly is an open-source scheduling and collaboration tool.
lukevella
Records13All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9
Exploited now
lukevella records in CISA KEVNo lukevella vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
13 records
TI-2025-40207 CVE-2025-65021
Rallly Has Unauthorized Poll Finalization via Insecure Direct Object Reference (IDOR)
Priority HIGH 72
Rallly is an open-source scheduling and collaboration tool.
TI-2025-40220 CVE-2025-65034
Rallly Improper Authorization Allows Reopening of Any Finalized Poll via Public pollId
Priority HIGH 70
Rallly is an open-source scheduling and collaboration tool.
TI-2025-40219 CVE-2025-65033
Rallly Broken Authorization: Any User Can Pause or Resume Any Poll via Poll ID Manipulation
Priority HIGH 70
Rallly is an open-source scheduling and collaboration tool.
TI-2025-40215 CVE-2025-65029
Rallly Has an IDOR Vulnerability in Participant Deletion Endpoint Allows Unauthorized Removal of Poll Participants
Priority HIGH 68
Rallly is an open-source scheduling and collaboration tool.
TI-2025-40553 CVE-2025-66027
Rallly Information Disclosure Vulnerability in Participant API Leaks Names and Emails Despite Pro Privacy Settings
Priority MEDIUM 64
Rallly is an open-source scheduling and collaboration tool.
TI-2025-40216 CVE-2025-65030
Rallly Improper Authorization in Comment Deletion Endpoint Allows Unauthorized Comment Removal
Priority MEDIUM 64
Rallly is an open-source scheduling and collaboration tool.
TI-2025-40218 CVE-2025-65032
Rallly Has an IDOR Vulnerability in Participant Rename Function Allows Unauthorized Modification of Other Users’ Names
Priority MEDIUM 62
Rallly is an open-source scheduling and collaboration tool.
TI-2025-40217 CVE-2025-65031
Rallly Improper Authorization in Comment Endpoint Allows User Impersonation
Priority MEDIUM 62
Rallly is an open-source scheduling and collaboration tool.
TI-2025-40214 CVE-2025-65028
Rallly Has an IDOR Vulnerability in Vote Update Endpoint Allows Unauthorized Manipulation of Participant Votes
Priority MEDIUM 62
Rallly is an open-source scheduling and collaboration tool.
TI-2025-40206 CVE-2025-65020
Rallly Has Unauthorized Poll Duplication via Insecure Direct Object Reference (IDOR)
Priority MEDIUM 62
Rallly is an open-source scheduling and collaboration tool.
TI-2026-05691 CVE-2026-6493 · GHSA-cv47-g53v-q848
lukevella rallly Reset Password reset-password-form.tsx cross site scripting
Priority MEDIUM 56
A flaw has been found in lukevella rallly up to 4.7.4.
TI-2026-62424 CVE-2026-92565 · GHSA-36pr-h5jw-r82m
Rallly before 4.15.0 Information Disclosure via polls.get
Priority LOW 37
Rallly before 4.15.0 contains an information disclosure vulnerability in the polls.get tRPC procedure that returns scheduled-event invitee names and email addresses to unauthenticated callers.