CVE-2026-97685

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-97685
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97685.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-97685
Published
2026-09-29T02:20:43Z
Modified
2026-10-21T03:00:22Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
LimeSurvey Community Edition 7.3.0 - Cross-survey object authorization bypass in REST survey patch operations
Details

An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an authorized context while supplying question or answer identifiers belonging to another user's survey. The REST survey-patching endpoint checks the attacker's permission against the survey ID in the request URL, but the vulnerable persistence operations resolve the target object independently by its global qid or aid and never verify that it belongs to that authorized survey.

Database specific 
{
    "cna_assigner":  "Fluid Attacks",
    "cwe_ids":  [
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97685.json"
}
References

Affected packages

Git / github.com/limesurvey/limesurvey

Affected ranges

Type
GIT
Repo
https://github.com/limesurvey/limesurvey
Events
Introduced
633b50f930451896cccd3437e3ebf4599b767a81
Fixed
a39a01537a8f79581bd630bcac94f71ae6ce2cce
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "7.3.0"
                },
                {
                    "last_affected":  "7.3.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "fixed":  "a39a01537a8f79581bd630bcac94f71ae6ce2cce"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

7.*
7.3.0
7.3.0+260922

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97685.json"