PT-2026-102439
CVE-2026-97685
·
تاريخ النشر
2026-09-29
·
تاريخ التحديث
2026-09-29
الوصف من
CVSS 4.0
7.1
عاليةالمقاييسAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
LimeSurvey Community Edition version 7.3.0
Description
An authenticated user with permissions to create surveys can manipulate the REST survey-patching endpoint. While the system verifies the user's permission against the survey ID in the request URL, the persistence operations resolve target objects using global
qid (question identifier) or aid (answer identifier) without verifying if these objects belong to the authorized survey. This allows a user to modify questions or answers belonging to another user's survey.Recommendations
Update LimeSurvey Community Edition to a version newer than 7.3.0.
As a temporary mitigation, restrict access to the REST survey-patching endpoint for users who do not require survey modification privileges.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾