A critical authorization bypass vulnerability in Rallly allows authenticated attackers to modify the state of unauthorized polls, impacting data integrity and availability.

This vulnerability is classified as an authorization bypass through a user-controlled key (CWE-639). Any authenticated user can force the reopening of finalized polls created by others by manipulating the pollId parameter in the application request.

The ability for unauthorized users to alter the status of finalized events poses a significant risk to organizational coordination and data integrity. Because this flaw allows for the disruption of scheduled events, it can result in operational downtime and loss of trust in collaboration platforms. With a CVSS score of 8.1, the high impact on data integrity and availability necessitates immediate attention to prevent malicious interference with administrative workflows.

Immediate Action: Upgrade to Rallly version 4.5.4 or later immediately to incorporate the vendor-supplied authorization checks.

Proactive Monitoring: Review application access logs for unusual patterns involving modifications to poll states or unauthorized attempts to access finalized poll identifiers.

Compensating Controls: Implement strict network access controls or Web Application Firewall (WAF) rules to limit access to the Rallly instance to known, authorized users, reducing the pool of potential attackers who could exploit this flaw.

Public Exploit Available: Unknown.

Given the potential for unauthorized state changes in scheduling data, organizations should prioritize upgrading to version 4.5.4. While the vulnerability requires authentication, the low barrier to entry for any registered user makes this a significant risk for collaborative environments. Apply the patch immediately to restore proper authorization controls.