Summary
An improper authorization vulnerability allows any authenticated user to reopen finalized polls belonging to other users by manipulating the pollId parameter. This can disrupt events managed by other users and compromise both availability and integrity of poll data.
Details
In the affected endpoint responsible for reopening finalized polls, the application does not verify that the user performing the action is the poll owner. As a result, any authenticated user can intercept a legitimate request to reopen their own poll, modify the pollId parameter to reference another user’s poll, and successfully reopen it.
The vulnerability exists due to a missing ownership check on the backend for the pollId parameter.
Vulnerable endpoint :
PoC
Test Environment Setup
Target: Local Rallly instance — http://192.168.11.109:3000/
Victim (User A): fairalien — Poll owner
Attacker (User B): hehe — Normal user
Steps to Reproduce
-
As User A, create and finalize a poll.
-
As User B, intercept your own legitimate “reopen poll” request .
- Modify the pollId parameter in the request body to use the victim’s poll ID and Forward the modified request.
- Observe that the victim’s finalized poll has been successfully reopened and no events appear.
Impact
This is an Insecure Direct Object Reference (IDOR) vulnerability that allows unauthorized reopening of finalized polls.
Attackers can:
-
Reopen other users’ finalized events without permission.
-
Potentially disrupt ongoing scheduling or availability processes.
-
Undermine trust and integrity of event data in the system.
alaeddine03 Reporter
Summary
An improper authorization vulnerability allows any authenticated user to reopen finalized polls belonging to other users by manipulating the
pollIdparameter. This can disrupt events managed by other users and compromise both availability and integrity of poll data.Details
In the affected endpoint responsible for reopening finalized polls, the application does not verify that the user performing the action is the poll owner. As a result, any authenticated user can intercept a legitimate request to reopen their own poll, modify the pollId parameter to reference another user’s poll, and successfully reopen it.
The vulnerability exists due to a missing ownership check on the backend for the pollId parameter.
Vulnerable endpoint :
/api/trpc/polls.reopenPoC
Test Environment Setup
Target: Local Rallly instance — http://192.168.11.109:3000/
Victim (User A): fairalien — Poll owner
Attacker (User B): hehe — Normal user
Steps to Reproduce
As User A, create and finalize a poll.
As User B, intercept your own legitimate “reopen poll” request .
Impact
This is an Insecure Direct Object Reference (IDOR) vulnerability that allows unauthorized reopening of finalized polls.
Attackers can:
Reopen other users’ finalized events without permission.
Potentially disrupt ongoing scheduling or availability processes.
Undermine trust and integrity of event data in the system.