EUVD-2026-88608
GHSA-c7fj-2fxp-jqpf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network REST endpoint (AV:N/AC:L), requires an authenticated survey-creator account (PR:L), no user interaction; impact is unauthorized modification of another tenant's data (I:H) with no confirmed confidentiality or availability loss.
Primary rating from Vendor (Fluid Attacks).
CVSS VectorVendor: Fluid Attacks
Lifecycle Timeline
3DescriptionCVE.org
An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an authorized context while supplying question or answer identifiers belonging to another user's survey. The REST survey-patching endpoint checks the attacker's permission against the survey ID in the request URL, but the vulnerable persistence operations resolve the target object independently by its global qid or aid and never verify that it belongs to that authorized survey.
AnalysisAI
Broken object-level authorization in LimeSurvey Community Edition 7.3.0 lets an authenticated user who holds survey-creation rights tamper with questions, answers, and conditions that belong to other users' surveys. The REST survey-patching endpoint validates the caller's permission against the survey ID in the request URL (the attacker's own survey), but the underlying persistence logic resolves the target question (qid) or answer (aid) globally by ID and never confirms the object actually belongs to that authorized survey. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated LimeSurvey account with permission to create surveys (PR:L), and the target instance must expose the REST survey-patching API. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine, well-characterized authorization flaw (CWE-639, IDOR/BOLA) rather than a high-CVSS-but-hollow issue, though it sits in the medium-to-high band, not critical. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream fix in commit a39a01537a8f79581bd630bcac94f71ae6ce2cce (https://github.com/LimeSurvey/LimeSurvey/commit/a39a01537a8f79581bd630bcac94f71ae6ce2cce) and upgrade to the LimeSurvey release that contains it; note that a released patched version number is not independently confirmed from the provided data, so validate the fixed build against the vendor advisory (https://fluidattacks.com/es/advisories/zoo) before considering the instance clean. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all instances of LimeSurvey Community Edition 7.3.0 and restrict survey-creation privileges to only essential trusted users, while monitoring for unauthorized survey modifications. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today