LimeSurvey Community Edition 7.0.5 contains an authenticated authorization flaw that allows a user with only read access to the global settings to issue a POST request to /index.php/admin/menuentries/sa/create and create new survey menu entries without the required update permission. The endpoint also accepts menu identifiers that the normal interface hides from non‑superadministrators, enabling the attacker to modify administrative navigation records that should remain exclusive to privileged users. This flaw is listed under CWE-862, indicating an improper authorization weakness that can lead to unauthorized configuration changes.

The vulnerability affects LimeSurvey Community Edition 7.0.5 on all supported platforms, including Linux, macOS, and Windows as reflected in the CPE entries for that version. No other versions are affected according to the available data.

The CVSS score of 5.1 signifies moderate severity, and the EPSS score is not available. The flaw is not listed in CISA’s KEV catalog. Exploitation requires an authenticated account that possesses only global‑settings read permission, which is typically a low‑privileged user. The vulnerable POST endpoint can be invoked directly to create administrative menu entries and alter navigation links, potentially facilitating further privilege escalation or denial-of-service conditions by disrupting the admin interface. Given the lack of a remote code execution vector, the risk remains confined to unauthorized configuration changes rather than full system compromise.