Technical impact
An authenticated user who can create surveys in LimeSurvey Community Edition 7.3.0 can use the REST survey‑patching endpoint to modify a question or answer that belongs to another user’s survey. The vulnerability arises because the endpoint checks the creator’s permission only against the survey ID provided in the request URL, while the persistence layer resolves the target object solely by its global question or answer ID and never verifies that the object is contained in the authorized survey. This allows an attacker to change, add, or delete content in any survey for which they do not have explicit rights, thereby compromising the integrity of other users’ data and potentially revealing sensitive survey content.
Affected Systems
All installations of LimeSurvey Community Edition 7.3.0 on Linux, macOS, and Windows are affected. The flaw exists only in version 7.3.0; subsequent releases have not been documented as impacted.
Risk and Exploitability
The CVSS score of 7.1 indicates a moderate to high severity. EPSS data are not available, making it unclear how frequently this issue is exploited in the wild. The flaw is listed as not part of the CISA KEV catalog. Exploitation requires an authenticated account with survey‑creation permissions and knowledge of the global IDs for the target question or answer. Attackers manipulate the REST payload to rewrite or delete content across survey boundaries. While insider or compromised credentials are necessary, the complexity of the operation is relatively low for an adversary with the required scope.
