Read the docs
TI-2026-64260 Aliases CVE-2026-97685GHSA-c7fj-2fxp-jqpf

LimeSurvey Community Edition 7.3.0 - Cross-survey object authorization bypass in REST survey patch operations

Priority MEDIUM 64CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an authorized context while supplying question or answer identifiers belonging to another user's survey. The REST survey-patching endpoint checks the attacker's permission against the survey ID in the request URL, but the vulnerable persistence operations resolve the target object independently by its global qid or aid and never verify that it belongs to that authorized survey.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00302 23rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LimeSurveyLimeSurvey7.3.0—No fix listedCNA
  • LimeSurvey VendorLimeSurvey Affected 7.3.0 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:limesurvey:limesurvey:*:*:*:*:*:*:*:*——LimeSurvey
  • cpe:2.3:a:limesurvey:limesurvey:*:*:*:*:*:*:*:* Versions — — ·LimeSurvey

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-97685
  2. 2026-10-03 Alias added: GHSA-c7fj-2fxp-jqpf

References

Patch 1

Advisory 1

Other 1

  • TI-2020-09194 LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in… CVSS 3.1CRITICAL 9.8
  • TI-2025-24280 LimeSurvey 2.0+ - 2.06+ Unauthenticated Arbitrary File Download via Serialized Backup Payload CVSS 4.0HIGH 8.7
  • TI-2024-28662 An issue in the js_localize.php function of LimeSurvey v6.6.2 and before allows attackers… CVSS 3.1HIGH 8.8
  • TI-2024-26167 Lime Survey <= 6.5.12 is vulnerable to Cross Site Request Forgery (CSRF). CVSS 3.1HIGH 8.8
  • TI-2026-45174 LimeSurvey Community Edition 7.0.5 - Reflected XSS in HTML editor popup CVSS 4.0HIGH 8.5
  • TI-2026-61986 LimeSurvey Community Edition 7.0.14 - Reflected XSS through unescaped LSS survey-import warnings CVSS 4.0HIGH 7.4
See all 96 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences