LimeSurvey builds password‑reset URLs directly from the HTTP Host header without validating the value. Because the optional allowedHosts setting is undefined in the default configuration, no host filtering occurs. An unauthenticated attacker who knows a user’s username and email can send a password‑reset request with a spoofed Host header. The system then emails the user a reset link that points to the attacker’s host but contains a valid, secret validation key. When the recipient or an automated mail‑security scanner follows the link, the attacker learns the secret key and can replay it against the legitimate LimeSurvey instance to reset the account password and take over the account. This results in unauthorized access to the victim’s account and the data it protects.

The vulnerability affects all LimeSurvey installations that use the default configuration (where allowedHosts is unspecified). No specific version information was provided in the CVE data, so any deployed instance is potentially vulnerable.

With a CVSS score of 8.7 the flaw is considered high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit it remotely by submitting a crafted HTTP request to the forgotten‑password endpoint; no prior authentication is needed. Successful exploitation results in compromise of the victim’s account and potential access to all data behind that account.