Lukevella vulnerabilities
We track 6 vulnerabilities in Lukevella products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on November 19, 2025.
Latest Lukevella vulnerabilities
- 8.1 High severity
rallly: Authorization Bypass Through User-Controlled Key
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an improper authorization vulnerability allows any authenticated user to reopen finalized polls belonging to other users by manipulating the pollId parameter. This can disrupt
- 8.1 High severity
rallly: Improper Authorization
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an authorization flaw in the poll management feature allows any authenticated user to pause or resume any poll, regardless of ownership. The system only uses the public pollId
- 7.1 High severity
rallly: Improper Authorization
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an authorization flaw in the comment deletion API allows any authenticated user to delete comments belonging to other users, including poll owners and administrators. The endpo
- 8.1 High severity
rallly: Improper Authorization
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an insecure direct object reference (IDOR) vulnerability allows any authenticated user to delete arbitrary participants from polls without ownership verification. The endpoint
- 9.1 Critical severity
rallly: Improper Authorization
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object Reference (IDOR) vulnerability exists in the poll finalization feature of the application. Any authenticated user can finalize a poll they do not own
- 9.8 Critical severity
rallly: Insufficient Entropy
Rallly is an open-source scheduling and collaboration tool. Versions up to and including 3.22.1 of the application features token based authentication. When a user attempts to login to the application, they insert their email and a 6 digit code is sent to thei