Skip to content
Rallly vulnerabilities
Newest
-
lukevella rallly
Rallly Information Disclosure Vulnerability in Participant API Leaks Names and Emails Despite Pro Privacy Settings
CVE-2025-66027
7.1 High
-
lukevella rallly
Rallly Improper Authorization Allows Reopening of Any Finalized Poll via Public pollId
CVE-2025-65034
8.1 High
-
lukevella rallly
Rallly Broken Authorization: Any User Can Pause or Resume Any Poll via Poll ID Manipulation
CVE-2025-65033
8.1 High
-
lukevella rallly
Rallly Has an IDOR Vulnerability in Participant Rename Function Allows Unauthorized Modification of Other Users’ Names
CVE-2025-65032
6.5 Medium
-
lukevella rallly
Rallly Improper Authorization in Comment Endpoint Allows User Impersonation
CVE-2025-65031
6.5 Medium
-
lukevella rallly
Rallly Improper Authorization in Comment Deletion Endpoint Allows Unauthorized Comment Removal
CVE-2025-65030
7.1 High
-
lukevella rallly
Rallly Has an IDOR Vulnerability in Participant Deletion Endpoint Allows Unauthorized Removal of Poll Participants
CVE-2025-65029
8.1 High
-
lukevella rallly
Rallly Has Unauthorized Poll Finalization via Insecure Direct Object Reference (IDOR)
CVE-2025-65021
9.1 Critical
-
lukevella rallly
Rallly Has Unauthorized Poll Duplication via Insecure Direct Object Reference (IDOR)
CVE-2025-65020
6.5 Medium
-
lukevella rallly
Rallly Has an IDOR Vulnerability in Vote Update Endpoint Allows Unauthorized Manipulation of Participant Votes
CVE-2025-65028
6.5 Medium
-
lukevella rallly
Rallly Insufficient Password Login Token Entropy Leads to Account Takeover
CVE-2025-47781
9.8 Critical