A critical authorization bypass in the Rallly scheduling application allows any authenticated user to disrupt polls belonging to other users, threatening the integrity and availability of the service.

The application fails to perform adequate authorization checks within the poll management feature, relying solely on a user-controlled pollId. This allows any authenticated user to pause or resume arbitrary polls, violating ownership constraints and access control policies.

The vulnerability carries a CVSS score of 8.1, reflecting a high impact on data integrity and service availability. Successful exploitation allows unauthorized users to disrupt collaborative scheduling activities, which may lead to significant operational downtime for teams relying on the platform, reputational damage, and the loss of trust in the scheduling process.

Immediate Action: Upgrade to Rallly version 4.5.4 or later immediately to apply the required authorization checks.

Proactive Monitoring: Review application access logs for unusual patterns involving frequent state changes to polls by users not associated with the original creation event.

Compensating Controls: Implement strict network access controls to limit the reach of unauthorized users, though this is secondary to applying the vendor-provided patch.

Public Exploit Available: Unknown

Given the ease with which an authenticated user can impact the availability of the platform, the risk to operational continuity is significant. Administrators should prioritize the update to version 4.5.4 to enforce correct ownership validation and prevent unauthorized manipulation of polling data.