CVE-2026-97685: high-severity vulnerability in LimeSurvey
LimeSurvey Community Edition 7.3.0 - Cross-survey object authorization bypass in REST survey patch operations
Published · Updated
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.1epss 0.2%
exploitation probability
0.2%top 86% of all CVEs
observed exploitation
nono source reports it
An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an authorized context while supplying question or answer identifiers belonging to another user's survey. The REST survey-patching endpoint checks the attacker's permission against the survey ID in the request URL, but the vulnerable persistence operations resolve the target object independently by its global qid or aid and never verify that it belongs to that authorized survey.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
LimeSurvey · LimeSurveyRelated CVEs — LimeSurvey
In the same product, most dangerous first.
CVE-2026-50635HIGHLimeSurvey Password Reset Host Header Injection Discloses Reset TokenEPSS 0.7%CVE-2025-41375CRITICALSQL Injection in LimesurveyEPSS 0.6%CVE-2026-50636HIGHLimeSurvey RemoteControl invite_participants/remind_participants SQL InjectionEPSS 0.6%CVE-2026-63361HIGHLimeSurvey Community Edition 7.0.5 - Reflected XSS in HTML editor popupEPSS 0.5%CVE-2025-41376MEDIUMCRLF Injection in LimesurveyEPSS 0.5%CVE-2026-63360HIGHLimeSurvey Community Edition 7.0.5 - Reflected XSS in user activation confirmation endpointEPSS 0.5%