CVE-2025-65020

CVE-2025-65020 describes an Insecure Direct Object Reference (IDOR) vulnerability in Rallly, an open-source scheduling tool, affecting versions prior to 4.5.4. An authenticated attacker can exploit this flaw by manipulating the pollId parameter in the /api/trpc/polls.duplicate endpoint, allowing them to duplicate any poll, including private or administrative ones, regardless of ownership. This medium-severity vulnerability (CVSS 6.5) has a low attack complexity and no user interaction required, potentially leading to unauthorized information disclosure and modification. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.