felhom.eu/documentation/audits/security-app-updates-2026-10-27/triage-notes/rallly.md

rallly — triage (pin lukevella/rallly:4.15.3; postgres:18-alpine untouched)

Template: setup_gate: true (closed to strangers only until first admin; public after). No SSO / conferencing env in compose.

Notices

• GHSA-gmq4-f8j5-8w8q — REAL. critical (CVSS 9.8-class, Next.js next/og RCE). Range >=4.8.0 <4.15.4 covers 4.15.3. Login: none (/api/og-image-poll unauthenticated). Reachable on a box: YES once setup is done (public subdomain). Fixed 4.15.4.
• release:v4.15.4 — REAL, same as the GHSA above.
• release:v4.15.5 — REAL: Next.js GHSA-p3m5-59mp-jv5r Server Actions DoS (high, no login). Fixed 4.15.5.
• release:v4.16.2 — REAL runtime fix: image rebuilt on Node.js 24.22.1 (Oct-2026 Node security release, Brotli RCE CVE-2026-111497 + TLS/DNS).
• release:v4.16.0 — NOT-A-FINDING: hit on "Control Panel tells you ... whether it fixes a security issue" (feature text).

Fix

Smallest fix for the GHSA: 4.15.4. Smallest fixing every real item: 4.16.2. TARGET: lukevella/rallly:4.16.3 (Docker Hub tag exists; no v prefix, as our pin). Same main (4): yes. Breaking/migrations read in 6 releases (4.15.4..4.16.3):

• 4.16.0: 13 DB migrations run on start (additive — fine); Microsoft multi-tenant SSO sign-in now needs verified email claims (we ship no MS SSO); SMTP_DEBUG no longer does anything (not in our compose); new in-memory rate limit 200 responses/poll/hour, needs X-Real-IP from the proxy (our compose strips XFF, traefik sets X-Real-Ip — verify live that the tunnel does not make every visitor one IP); new hourly update check to api.rallly.co.
• 4.16.1: optional GOOGLE_/MICROSOFT_LOGIN_ENABLED. 4.16.3: DST fix only. None of these is a file migration, a removed config we use, or a new required service. Lane: SECURITY_FIX to 4.16.3. (Conservative alternative: 4.15.5 = Next.js fixes only, but it misses the Node runtime fix of 4.16.2.) Workaround until shipped: block /api/og-image-poll at traefik. Classifier note: release:v4.16.0 is a word-match on "security issue" in a feature description — not a fix.