PT-2026-102439 · Unknown · Lime Survey Community Edition
CVSS v4.0
7.1
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
LimeSurvey Community Edition version 7.3.0
Description
An authenticated user with permissions to create surveys can manipulate the REST survey-patching endpoint. While the system verifies the user's permission against the survey ID in the request URL, the persistence operations resolve target objects using global
qid (question identifier) or aid (answer identifier) without verifying if these objects belong to the authorized survey. This allows a user to modify questions or answers belonging to another user's survey.Recommendations
Update LimeSurvey Community Edition to a version newer than 7.3.0.
As a temporary mitigation, restrict access to the REST survey-patching endpoint for users who do not require survey modification privileges.
Exploit
Fix
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Lime Survey Community Edition