A critical authorization vulnerability in Rallly allows any authenticated user to delete arbitrary comments, potentially leading to unauthorized data destruction.

The application contains an improper authorization flaw in its comment deletion API endpoint. By manipulating the comment ID, any authenticated user can delete comments they do not own, as the system fails to validate ownership or administrative privileges.

This vulnerability carries a CVSS score of 7.1, indicating a high risk to data integrity within the collaboration platform. Successful exploitation allows unauthorized users to perform destructive actions against shared content, which may disrupt project workflows, facilitate the removal of evidence, or compromise the administrative control of polls.

Immediate Action: Update the Rallly installation to version 4.5.4 or later to implement the necessary authorization checks.

Proactive Monitoring: Review application access logs for unusual patterns involving bulk comment deletion or requests targeting comment IDs not associated with the authenticated user.

Compensating Controls: If an immediate update is not feasible, restrict access to the application to trusted users only and implement request rate limiting to hinder automated mass-deletion attempts.

Public Exploit Available: Unknown

Given the potential for unauthorized data manipulation, organizations using Rallly must prioritize upgrading to version 4.5.4 immediately. This update effectively closes the authorization gap and ensures that users can only interact with their own data, thereby restoring the integrity of the collaboration environment.