Rallly is a scheduling and event-coordination application with a prominent footprint among its user base, where vulnerabilities concentrate in authorization and data-exposure mechanisms. The vendor's disclosed flaws skew toward serious outcomes and recur across weakness classes including authorization bypasses driven by user-controlled keys, improper or missing access controls, and exposure of sensitive personal information—patterns that reflect the application's role in handling calendar data and participant details. Defenders should prioritize authorization-layer updates for this product and audit access controls around user data; current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Rallly over time
Signals from CVEs in this vendor scope (11 CVEs).
11 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-65021CRITICAL Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object Reference (IDOR) vulnerability exists in the poll finalization feature | Nov 19, 2025 | 9.1 | 33 | NO | NO |
CVE-2025-65034HIGH Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an improper authorization vulnerability allows any authenticated user to reopen finalized polls | Nov 19, 2025 | 8.1 | 27 | NO | NO |
CVE-2025-65033HIGH Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an authorization flaw in the poll management feature allows any authenticated user to pause or r | Nov 19, 2025 | 8.1 | 27 | NO | NO |
CVE-2025-65029HIGH Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an insecure direct object reference (IDOR) vulnerability allows any authenticated user to delete | Nov 19, 2025 | 8.1 | 27 | NO | NO |
CVE-2025-47781CRITICAL Rallly is an open-source scheduling and collaboration tool. Versions up to and including 3.22.1 of the application features token based authentication. When a user attempts to logi | May 14, 2025 | 9.8 | 27 | NO | NO |
CVE-2025-65030HIGH Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an authorization flaw in the comment deletion API allows any authenticated user to delete commen | Nov 19, 2025 | 7.1 | 24 | NO | NO |
CVE-2025-65032MEDIUM Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object Reference (IDOR) vulnerability allows any authenticated user to change | Nov 19, 2025 | 6.5 | 22 | NO | NO |
CVE-2025-65031MEDIUM Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an improper authorization flaw in the comment creation endpoint allows authenticated users to im | Nov 19, 2025 | 6.5 | 22 | NO | NO |
CVE-2025-65028MEDIUM Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an insecure direct object reference (IDOR) vulnerability allows any authenticated user to modify | Nov 19, 2025 | 6.5 | 22 | NO | NO |
CVE-2025-66027MEDIUM Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.6, an information disclosure vulnerability exposes participant details, including names and email a | Nov 29, 2025 | 6.5 | 20 | NO | NO |
Signals from CVEs in this vendor scope (11 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Rallly.
Media articles that mention a CVE ID that affects a product developed by Rallly — matched by CVE ID, not by vendor name.