LimeSurvey Community Edition 7.3.0 - Cross-survey object authorization bypass in REST survey patch operations
An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an authorized context while supplying question or answer identifiers belonging to another user's survey. The REST survey-patching endpoint checks the attacker's permission against the survey ID in the request URL, but the vulnerable persistence operations resolve the target object independently by its global qid or aid and never verify that it belongs to that authorized survey.
CVE-2026-97685
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-97685
LimeSurvey
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "LimeSurvey",
"product": "LimeSurvey",
"versions": [
{
"status": "affected",
"version": "7.3.0"
}
],
"platforms": [
"Windows",
"MacOS",
"Linux"
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-97685
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #4469 · Revision 1
- Added to Heist Feed
- Publisher date