What’s Vulnerable › Vulnerabilities

CVE-2025-65030: Rallly Improper Authorization in Comment Deletion Endpoint Allows Unauthorized Comment Removal

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-11-19 · updated 2026-10-18
• Weakness: CWE-285

Description

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an authorization flaw in the comment deletion API allows any authenticated user to delete comments belonging to other users, including poll owners and administrators. The endpoint relies solely on the comment ID for deletion and does not validate whether the requesting user owns the comment or has permission to remove it. This issue has been patched in version 4.5.4.

Affected products

• lukevella rallly: before 4.5.4 — fixed in 4.5.4

How to fix

Upgrade to a fixed version: lukevella rallly 4.5.4. Check the vendor advisory for mitigations.

References

• https://github.com/lukevella/rallly/releases/tag/v4.5.4
• https://github.com/lukevella/rallly/security/advisories/GHSA-4j32-25f9-qgfm

Get alerted when CVE-2025-65030 or the next vulnerability affects your stack