Unauthorized Access in LimeSurvey Community Edition User Surveys

CVE-2026-97685

What is CVE-2026-97685?

An access control vulnerability exists in LimeSurvey Community Edition 7.3.0 that allows authenticated users to manipulate survey data. Users creating surveys can exploit their authorized context to access and alter questions or answers from other users' surveys. The flaw arises because the system verifies permissions based on the survey ID in the request URL, but the vulnerable operations can resolve survey elements independently, bypassing necessary checks. This oversight can lead to unauthorized modifications, raising significant concerns regarding data integrity and user privacy.

References