https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-66027.htmlhttps://patchthecve.com/cve/CVE-2025-66027.htmlWed, 07 Oct 2026 20:10:01 +0000MEDIUM 6.5: Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.6, an information disclosure vulnerability exposes participant details, including names and email addresses through the /api/trpc/polls.get,polls.participants.list endpoint, even when Pro privacy features are enabled. Thttps://patchthecve.com/cve/CVE-2025-65034.htmlhttps://patchthecve.com/cve/CVE-2025-65034.htmlSun, 18 Oct 2026 20:10:00 +0000HIGH 8.1: Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an improper authorization vulnerability allows any authenticated user to reopen finalized polls belonging to other users by manipulating the pollId parameter. This can disrupt events managed by other users and comprohttps://patchthecve.com/cve/CVE-2025-65033.htmlhttps://patchthecve.com/cve/CVE-2025-65033.htmlSun, 18 Oct 2026 20:10:00 +0000HIGH 8.1: Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an authorization flaw in the poll management feature allows any authenticated user to pause or resume any poll, regardless of ownership. The system only uses the public pollId to identify polls, and it does not verifhttps://patchthecve.com/cve/CVE-2025-65032.htmlhttps://patchthecve.com/cve/CVE-2025-65032.htmlSun, 18 Oct 2026 20:10:00 +0000MEDIUM 6.5: Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object Reference (IDOR) vulnerability allows any authenticated user to change the display names of other participants in polls without being an admin or the poll owner. By manipulating the participhttps://patchthecve.com/cve/CVE-2025-65031.htmlhttps://patchthecve.com/cve/CVE-2025-65031.htmlSun, 18 Oct 2026 20:10:00 +0000MEDIUM 6.5: Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an improper authorization flaw in the comment creation endpoint allows authenticated users to impersonate any other user by altering the authorName field in the API request. This enables attackers to post comments unhttps://patchthecve.com/cve/CVE-2025-65030.htmlhttps://patchthecve.com/cve/CVE-2025-65030.htmlSun, 18 Oct 2026 20:10:00 +0000HIGH 7.1: Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an authorization flaw in the comment deletion API allows any authenticated user to delete comments belonging to other users, including poll owners and administrators. The endpoint relies solely on the comment ID for https://patchthecve.com/cve/CVE-2025-65029.htmlhttps://patchthecve.com/cve/CVE-2025-65029.htmlSun, 18 Oct 2026 20:10:00 +0000HIGH 8.1: Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an insecure direct object reference (IDOR) vulnerability allows any authenticated user to delete arbitrary participants from polls without ownership verification. The endpoint relies solely on a participant ID to authttps://patchthecve.com/cve/CVE-2025-65028.htmlhttps://patchthecve.com/cve/CVE-2025-65028.htmlSun, 18 Oct 2026 20:10:00 +0000MEDIUM 6.5: Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an insecure direct object reference (IDOR) vulnerability allows any authenticated user to modify other participants’ votes in polls without authorization. The backend relies solely on the participantId parameter to ihttps://patchthecve.com/cve/CVE-2025-65021.htmlhttps://patchthecve.com/cve/CVE-2025-65021.htmlSun, 18 Oct 2026 20:10:00 +0000CRITICAL 9.1: Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object Reference (IDOR) vulnerability exists in the poll finalization feature of the application. Any authenticated user can finalize a poll they do not own by manipulating the pollId parameter in https://patchthecve.com/cve/CVE-2025-65020.htmlhttps://patchthecve.com/cve/CVE-2025-65020.htmlSun, 18 Oct 2026 20:10:00 +0000MEDIUM 6.5: Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object Reference (IDOR) vulnerability in the poll duplication endpoint (/api/trpc/polls.duplicate) allows any authenticated user to duplicate polls they do not own by modifying the pollId parameterhttps://patchthecve.com/cve/CVE-2025-47781.htmlhttps://patchthecve.com/cve/CVE-2025-47781.htmlWed, 17 Jun 2026 09:28:40 +0000CRITICAL 9.8: Rallly is an open-source scheduling and collaboration tool. Versions up to and including 3.22.1 of the application features token based authentication. When a user attempts to login to the application, they insert their email and a 6 digit code is sent to their email address to complete the authenti