CVE-2025-13829: NGSurvey Information Disclosure Flaw

CVE-2025-13829 Overview

CVE-2025-13829 is an incorrect authorization vulnerability [CWE-863] in Data Illusion Zumbrunn NGSurvey. The flaw allows any authenticated user to retrieve private information belonging to any other user of the application. Exposed data includes the user APIKEY valid for a one-year session, the RefreshToken valid for ten minutes, the bcrypt-hashed password, the user IP address, the email address, and the full name. The vendor addressed the issue in NGSurvey release 3.6.17 on 2025-05-28.

Critical Impact
Any logged-in user can harvest long-lived API keys, refresh tokens, password hashes, and personally identifiable information of every other NGSurvey user, enabling full account takeover.

Affected Products

Data Illusion Zumbrunn NGSurvey versions prior to 3.6.17
NGSurvey deployments exposing the affected authorization endpoint to authenticated users
Joomla installations bundling vulnerable NGSurvey component versions

Discovery Timeline

2025-05-28 - NGSurvey 3.6.17 released with the fix per the vendor change log
2025-12-01 - CVE-2025-13829 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-13829

Vulnerability Analysis

The vulnerability is an Incorrect Authorization weakness classified under [CWE-863]. NGSurvey performs an authorization check that fails to validate whether the requesting user owns the targeted user record. As a result, any authenticated session can request data tied to arbitrary user identifiers and receive a successful response.

The attack requires only low-privilege authenticated access over the network. No user interaction or elevated privileges are needed. An attacker with a standard account can enumerate user identifiers and pull sensitive records for every account in the system.

The data returned by the vulnerable endpoint is unusually sensitive. The leaked APIKEY provides a one-year session token usable for subsequent API calls. The RefreshToken allows session renewal. The bcrypt password hash enables offline cracking. Combined with the email and full name, an attacker gains everything needed for account takeover, lateral phishing, and credential reuse attacks against unrelated services.

Root Cause

The root cause is a missing object-level authorization check. The application authenticates the requester but does not enforce that the requester is authorized to access the specific resource identified in the request. This is a textbook Broken Object Level Authorization (BOLA) pattern.

Attack Vector

An attacker registers or compromises any low-privilege NGSurvey account. The attacker then issues authenticated requests to the affected endpoint, substituting target user identifiers to retrieve other users' records. The technical mechanism is documented in the NGSurvey Change Log Entry for release 3.6.17.

Detection Methods for CVE-2025-13829

Indicators of Compromise

Authenticated HTTP requests from a single session iterating sequentially through user identifier parameters against NGSurvey endpoints
Unexpected use of APIKEY values from IP addresses or user agents that differ from the legitimate owner
Bulk responses containing fields such as apikey, refresh_token, password hash, IP, and email returned to non-administrative accounts

Detection Strategies

Review NGSurvey application and web server access logs for high-volume authenticated requests targeting user data endpoints with varying identifier parameters
Alert on any account that retrieves user records at a rate inconsistent with normal survey workflows
Correlate NGSurvey APIKEY usage with the originating account's typical source IP and session geolocation

Monitoring Recommendations

Enable verbose access logging on the Joomla or web host fronting NGSurvey and forward logs to a centralized analytics platform
Track issuance and reuse of long-lived APIKEY and RefreshToken values for anomalies after upgrading
Monitor for password reset, email change, or API key regeneration events that follow data scraping patterns

How to Mitigate CVE-2025-13829

Immediate Actions Required

Upgrade NGSurvey to version 3.6.17 or later as published in the vendor change log on 2025-05-28
Rotate all NGSurvey APIKEY and RefreshToken values after upgrading, since previously issued tokens may be in attacker hands
Force a password reset for all NGSurvey accounts because bcrypt hashes may have been exfiltrated and subjected to offline cracking
Audit administrative and API activity for the period prior to the upgrade to identify suspicious data access

Patch Information

The vendor released NGSurvey 3.6.17 on 2025-05-28, which corrects the authorization check. Refer to the NGSurvey Change Log Entry for release notes and upgrade instructions.

Workarounds

Restrict NGSurvey access to trusted networks or VPN users until the patch is deployed
Disable self-service registration to limit the population of authenticated users who can exploit the flaw
Place a web application firewall in front of NGSurvey and block requests to user data endpoints that include user identifier parameters not matching the session owner

bash

# Configuration example: verify installed NGSurvey version meets the patched release
grep -R "version" /path/to/joomla/administrator/components/com_ngsurvey/ngsurvey.xml
# Expected output should show version 3.6.17 or higher