Lukevella Rallly vulnerabilities

• lukevella rallly Rallly before 4.15.0 Information Disclosure via polls.get CVE-2026-92565 6.9 MediumSeptember 16, 2026
• lukevella rallly lukevella rallly Reset Password reset-password-form.tsx cross site scripting CVE-2026-6493 5.1 MediumApril 17, 2026
• lukevella rallly Rallly Information Disclosure Vulnerability in Participant API Leaks Names and Emails Despite Pro Privacy Settings CVE-2025-66027 7.1 HighNovember 29, 2025
• lukevella rallly Rallly Improper Authorization Allows Reopening of Any Finalized Poll via Public pollId CVE-2025-65034 8.1 HighNovember 19, 2025
• lukevella rallly Rallly Broken Authorization: Any User Can Pause or Resume Any Poll via Poll ID Manipulation CVE-2025-65033 8.1 HighNovember 19, 2025
• lukevella rallly Rallly Has an IDOR Vulnerability in Participant Rename Function Allows Unauthorized Modification of Other Users’ Names CVE-2025-65032 6.5 MediumNovember 19, 2025
• lukevella rallly Rallly Improper Authorization in Comment Endpoint Allows User Impersonation CVE-2025-65031 6.5 MediumNovember 19, 2025
• lukevella rallly Rallly Improper Authorization in Comment Deletion Endpoint Allows Unauthorized Comment Removal CVE-2025-65030 7.1 HighNovember 19, 2025
• lukevella rallly Rallly Has an IDOR Vulnerability in Participant Deletion Endpoint Allows Unauthorized Removal of Poll Participants CVE-2025-65029 8.1 HighNovember 19, 2025
• lukevella rallly Rallly Has Unauthorized Poll Finalization via Insecure Direct Object Reference (IDOR) CVE-2025-65021 9.1 CriticalNovember 19, 2025
• lukevella rallly Rallly Has Unauthorized Poll Duplication via Insecure Direct Object Reference (IDOR) CVE-2025-65020 6.5 MediumNovember 19, 2025
• lukevella rallly Rallly Has an IDOR Vulnerability in Vote Update Endpoint Allows Unauthorized Manipulation of Participant Votes CVE-2025-65028 6.5 MediumNovember 19, 2025
• lukevella rallly Rallly Insufficient Password Login Token Entropy Leads to Account Takeover CVE-2025-47781 9.8 CriticalMay 14, 2025