Which versions of LimeSurvey are affected by CVE-2026-50635?

Account takeover vulnerability in LimeSurvey (CVE-2026-50635) enables unauthenticated attackers to reset user passwords via host header injection in the password reset workflow.. A patch is available.

How to fix or mitigate CVE-2026-50635?

Within 24 hours: Inventory all LimeSurvey instances and verify current version against vendor advisory. Within 7 days: Test patch available per vendor advisory in a non-production environment and plan deployment timeline. Within 30 days: Deploy patched LimeSurvey version to all production instances and require forced password resets for all user accounts as post-patch remediation.

LimeSurvey CVE-2026-50635

Q: What is the CVSS score of CVE-2026-50635?

CVE-2026-50635 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-35769 HIGH

Weak Password Recovery Mechanism for Forgotten Password (CWE-640)

2026-06-09 VulnCheck

GHSA-5c37-5j7w-8mh8

Information Disclosure Limesurvey

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 09, 2026 - 18:52 vuln.today

Analysis Generated

Jun 09, 2026 - 18:52 vuln.today

CVSS changed

Jun 09, 2026 - 18:22 NVD

8.8 (HIGH) 8.7 (HIGH)

DescriptionCVE.org

LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it. The optional allowedHosts allowlist that would constrain this is undefined in the default (and documented) configuration, so LSHttpRequest::checkIsAllowedHost() results in no operation. A remote, unauthenticated attacker who submits a forgotten-password request for a known account (requiring only the target's username and email) with a spoofed Host header causes LimeSurvey to email that account a reset link whose hostname is attacker-controlled while embedding the genuine validation_key. When the recipient or an automated inbound mail-security link scanner dereferences the link, the valid reset token is disclosed to the attacker, who replays it against the legitimate host's newPassword endpoint to set a new password and take over the account.

AnalysisAI

Account takeover in LimeSurvey is possible through host header injection in the forgotten-password workflow, where reset links are built from the client-supplied HTTP Host header without validation. Remote unauthenticated attackers who know a target's username and email can submit a password-reset request with a spoofed Host header, causing LimeSurvey to email the victim a reset link pointing to an attacker-controlled host while still embedding the valid reset token. Reported by VulnCheck with publicly available exploit code exists via the vendor PR diff, though no public exploit identified at time of analysis in CISA KEV.

Technical ContextAI

LimeSurvey is a widely deployed open-source PHP survey platform built on the Yii framework. The root cause is CWE-640 (Weak Password Recovery Mechanism), manifesting as a classic host header injection: LSHttpRequest::getHostInfo() trusts the inbound HTTP Host header to construct absolute URLs, and LSHttpRequest::checkIsAllowedHost() only enforces validation when the allowedHosts config array is populated. Because the default and documented configuration ships with allowedHosts undefined, the check becomes a no-op, so password reset emails generated by LimeMailer embed whatever hostname the attacker placed in the Host header alongside the genuine, server-issued validation_key. The affected CPE cpe:2.3:a:limesurvey:limesurvey:*:*:*:*:*:*:*:* spans all versions prior to the fix introduced in PR #5032, which adds an allowed_hosts.php config file, an isHostAllowed() check, and a createValidatedAbsoluteUrl() helper used by the mailer.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the changes from LimeSurvey PR #5032 (https://github.com/LimeSurvey/LimeSurvey/pull/5032) once incorporated into a tagged release, or backport the patch which introduces an application/config/allowed_hosts.php allowlist, an isHostAllowed() enforcement helper, and createValidatedAbsoluteUrl() usage in LimeMailer. As an immediate workaround that does not require waiting for a tagged release, administrators can manually populate the allowedHosts array in LimeSurvey's config with the legitimate hostname(s), which restores the pre-existing checkIsAllowedHost() enforcement path - the trade-off is that any multi-domain deployment must list every hostname explicitly or password-reset and opt-in/opt-out URLs will be rejected. Defenders should also reference the VulnCheck advisory at https://www.vulncheck.com/advisories/limesurvey-password-reset-host-header-injection-discloses-reset-token and consider fronting LimeSurvey with a reverse proxy that strips or overrides inbound Host headers to a known canonical value, accepting that this requires correct proxy configuration to avoid breaking legitimate vhost routing.