CVE-2025-65031 Overview
Rallly is an open-source scheduling and collaboration tool used to coordinate meetings and events. CVE-2025-65031 is an improper authorization flaw [CWE-285] in the comment creation endpoint of Rallly versions prior to 4.5.4. Authenticated users can impersonate any other user by altering the authorName field in the API request. The server accepts the client-supplied name without verifying it against the authenticated session identity. Attackers can post comments under arbitrary usernames, including privileged accounts such as administrators. The maintainers patched the issue in version 4.5.4.
Critical Impact
Authenticated attackers can post comments under any username, enabling phishing, social engineering, and reputation attacks against poll participants and administrators.
Affected Products
- Rallly versions prior to 4.5.4
- Self-hosted Rallly deployments exposing the comment API
- Managed Rallly instances running unpatched builds
Discovery Timeline
- 2025-11-19 - CVE-2025-65031 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-65031
Vulnerability Analysis
Rallly exposes an authenticated API endpoint that creates comments on scheduling polls. The endpoint accepts an authorName field in the request payload and stores it directly against the new comment record. The server does not validate that authorName matches the display name associated with the authenticated session. As a result, any logged-in user can supply an arbitrary value and have it rendered to other participants as the comment author.
The flaw is a server-side authorization gap, not a client rendering issue. Even users who never had access to an administrator account can produce comments that appear to come from one. Downstream users viewing the poll have no visible indicator that the displayed author is spoofed.
Root Cause
The root cause is missing authorization enforcement on a trust-sensitive field [CWE-285]. The comment creation handler treats the client-controlled authorName as authoritative rather than deriving the author identity from the authenticated session. The maintainers addressed this in version 4.5.4 by binding the comment author to the server-side session identity. See the Rallly v4.5.4 Release Notes and GitHub Security Advisory GHSA-hhfc-6gq7-rrpm for details.
Attack Vector
Exploitation requires only an authenticated Rallly account and network access to the application. An attacker submits a normal comment creation request through the web UI or directly to the API, replacing the authorName value with the display name of a target user, such as an administrator or event organizer. The forged comment is then shown to every participant viewing the poll. The attack requires no user interaction from the impersonated party.
The integrity impact is high because trust decisions made by participants, such as approving a schedule change or following a linked URL, may be based on a spoofed author identity.
Detection Methods for CVE-2025-65031
Indicators of Compromise
- Comment records where the stored authorName does not match the authenticated user ID associated with the request.
- Comments attributed to administrator or organizer accounts that were created from sessions belonging to standard users.
- Poll comment threads containing suspicious links or urgent instructions attributed to trusted users.
Detection Strategies
- Review application logs for comment creation requests and correlate the submitted authorName field with the session user identifier.
- Query the comments table for entries whose author display name differs from the current display name of the associated user account.
- Alert on any comment posted under an administrator name to trigger manual review.
Monitoring Recommendations
- Enable request-body logging on the comment API endpoint to preserve the raw authorName value.
- Monitor for spikes in comment creation volume from individual authenticated sessions.
- Track outbound links posted in comments to detect phishing infrastructure introduced through impersonated posts.
How to Mitigate CVE-2025-65031
Immediate Actions Required
- Upgrade all Rallly instances to version 4.5.4 or later without delay.
- Audit existing comments for impersonation, focusing on those attributed to administrators and organizers.
- Rotate any credentials or approvals that may have been influenced by spoofed comments during the exposure window.
Patch Information
The issue is fixed in Rallly version 4.5.4. The patch binds the comment author identity to the authenticated session rather than trusting the client-supplied authorName value. Release details are available in the Rallly v4.5.4 Release Notes and the GitHub Security Advisory GHSA-hhfc-6gq7-rrpm.
Workarounds
- Restrict access to the Rallly instance to trusted users until the upgrade is complete.
- Place the application behind an authenticated reverse proxy that logs full request bodies for later forensic review.
- Communicate to users that comment author names may be unreliable on unpatched deployments and to verify sensitive instructions out of band.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
