Which versions of Data Illusion Zumbrunn NGSurvey are affected by CVE-2025-13829?

Data Illusion Zumbrunn NGSurvey contains an authorization flaw (CVE-2025-13829, CVSS 8.6) that enables authenticated users to access resources beyond their assigned permissions, creating insider risk…. A patch is available.

How to fix or mitigate CVE-2025-13829?

Within 24 hours: Identify all NGSurvey instances in production and document current version numbers. Within 7 days: Apply vendor-released patch to all affected NGSurvey deployments; verify patch application through version confirmation and access control testing. Within 30 days: Conduct access audit to detect any unauthorized data access during the vulnerability window and review user activity logs for anomalous permission usage.

Data Illusion Zumbrunn NGSurvey CVE-2025-13829

Q: What is the CVSS score of CVE-2025-13829?

CVE-2025-13829 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-200016 HIGH

Incorrect Authorization (CWE-863)

2025-12-01 64c5ae8f-7972-4697-86a0-7ada793ac795

Authentication Bypass

8.6

CVSS 4.0 · Vendor: 64c5ae8f-7972-4697-86a0-7ada793ac795

Severity by source

Vendor (64c5ae8f-7972-4697-86a0-7ada793ac795) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X

Primary rating from Vendor (64c5ae8f-7972-4697-86a0-7ada793ac795) · only source for this CVE.

CVSS VectorVendor: 64c5ae8f-7972-4697-86a0-7ada793ac795

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:24 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

3.6.17

EUVD ID Assigned

Mar 15, 2026 - 13:34 euvd

EUVD-2025-200016

Analysis Generated

Mar 15, 2026 - 13:34 vuln.today

CVE Published

Dec 01, 2025 - 16:15 nvd

HIGH 8.6

DescriptionCVE.org

Incorrect Authorization vulnerability in Data Illusion Zumbrunn NGSurvey allows any logged-in user to obtain the private information of any other user.

Critical information retrieved:

APIKEY (1 year user Session)
RefreshToken (10 minutes user Session)
Password hashed with bcrypt
User IP
Email
Full Name

AnalysisAI

A security vulnerability in Incorrect Authorization vulnerability in Data Illusion Zumbrunn NGSurvey (CVSS 8.6) that allows any logged-in user. High severity vulnerability requiring prompt remediation.

Technical ContextAI

CWE-863 (Incorrect Authorization). CVSS 8.6 indicates high severity. Affects Incorrect Authorization vulnerability in Data Illusion Zumbrunn NGSurvey.