An authorization bypass vulnerability in the Rallly scheduling tool allows authenticated users to delete poll participants, posing a risk to data integrity and service availability.

This is an insecure direct object reference (IDOR) flaw where the application fails to perform ownership verification on participant IDs during deletion requests. Any authenticated user can trigger this action to remove other users, including poll owners, from any poll.

Successful exploitation of this vulnerability directly undermines the integrity and availability of poll data. By allowing unauthorized users to remove participants or poll owners, attackers can disrupt collaboration workflows and compromise the administrative control of ongoing scheduling events. With a CVSS score of 8.1, this high-severity flaw necessitates prompt attention to prevent unauthorized disruption of business operations.

Immediate Action: Upgrade the Rallly installation to version 4.5.4 or later to implement the mandatory ownership verification checks.

Proactive Monitoring: Review application access logs for suspicious patterns of participant deletion requests, specifically looking for high volumes of API calls targeting the participant removal endpoint.

Compensating Controls: Implement strict network access controls or a Web Application Firewall (WAF) to restrict access to the application to authorized users only, reducing the attack surface available to unauthorized actors.

Public Exploit Available: Unknown.

Given the potential for unauthorized data modification and service disruption, administrators should prioritize updating to version 4.5.4 immediately. This update addresses the core authorization failure by ensuring that only authorized owners can manage poll participation, effectively neutralizing the risk of arbitrary user deletion.