Is CVE-2025-65020 actively exploited?

No active exploitation of CVE-2025-65020 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2025-65020 be exploited remotely?

Yes. CVE-2025-65020 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2025-65020?

CVE-2025-65020 has a CVSS score of 6.5 (MEDIUM).

HOME VULNERABILITIESCVE-2025-65020

MEDIUM

CVE-2025-65020

CWE-285Published: November 19, 2025· Updated: Jun 17, 2026

6.5

CVSS v3.1

Official Description

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object Reference (IDOR) vulnerability in the poll duplication endpoint (/api/trpc/polls.duplicate) allows any authenticated user to duplicate polls they do not own by modifying the pollId parameter. This effectively bypasses access control and lets unauthorized users clone private or administrative polls. This issue has been patched in version 4.5.4.

NVD Source

Technical Analysis

CVE-2025-65020 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.