CVE-2026-97685: LimeSurvey Auth Bypass Vulnerability

CVE-2026-97685 Overview

CVE-2026-97685 is a broken access control vulnerability [CWE-639] in LimeSurvey Community Edition 7.3.0. An authenticated user with permission to create surveys can manipulate the REST survey-patching endpoint to modify questions or answers belonging to surveys owned by other users. The endpoint validates the caller's permission against the survey ID passed in the request URL, but downstream persistence operations resolve the target object by its global question ID (qid) or answer ID (aid) without confirming that it belongs to the authorized survey. This mismatch allows horizontal privilege escalation across tenant boundaries.

Critical Impact
An authenticated LimeSurvey user can tamper with questions and answers in surveys owned by other users, resulting in integrity loss across unrelated survey data.

Affected Products

LimeSurvey Community Edition 7.3.0
LimeSurvey REST survey-patching API (SurveyPatch command handlers)
Deployments exposing the authenticated /rest survey endpoints to multiple tenants

Discovery Timeline

2026-09-29 - CVE-2026-97685 published to the National Vulnerability Database
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-97685

Vulnerability Analysis

The flaw resides in the LimeSurvey REST survey-patching endpoint, specifically the operation handlers under application/libraries/Api/Command/V1/SurveyPatch/. When a client submits a patch operation, the framework performs an authorization check against the survey ID in the request URL. The handler then persists changes to questions, answers, conditions, or localizations using identifiers supplied in the request body.

The persistence layer resolves those identifiers globally. Handlers such as OpHandlerQuestionCreate and OpHandlerQuestionL10nUpdate accept a qid or aid and load the corresponding record from the database without verifying its parent survey. An attacker who legitimately owns Survey A can therefore issue a patch request scoped to Survey A while supplying question or answer identifiers that belong to Survey B.

Root Cause

The vulnerability is a textbook Insecure Direct Object Reference [CWE-639]. Authorization and object resolution operate on different keys. The URL-level survey ID gates the endpoint, but the object lookup uses a global primary key. No relational check links the target qid or aid back to the survey that the caller is authorized to modify. Related operations, such as copying conditions between questions via Condition::model()->copyConditions(), inherited the same missing check.

Attack Vector

Exploitation requires an authenticated account with permission to create surveys. The attacker creates a survey under their own account to satisfy the endpoint-level permission check. They then send a survey-patch request whose URL references their survey but whose payload embeds qid or aid values enumerated from another tenant's survey. The server applies the write to those foreign records, allowing modification of another user's questions, answers, translations, or conditional logic.

php

// Vendor patch: filter condition IDs so only those belonging to the
// authorized survey are copied. Source: LimeSurvey commit a39a0153
                    $cids[] = $rawCondition['cid'];
                }
            }
-            Condition::model()->copyConditions($cids, $question->qid);
+            $cids = $this->filterConditionIdsBySurvey($cids, $surveyId);
+            if (!empty($cids)) {
+                Condition::model()->copyConditions($cids, $question->qid);
+            }
        }
        return ['tempIdMapping' => $mapping];
    }

+    /**
+     * Returns only the condition IDs that belong to questions of the given
+     * survey, so conditions of other surveys cannot be copied.
+     */
+    private function filterConditionIdsBySurvey(array $cids, int $surveyId): array
+    {
+        $cids = array_map('intval', $cids);
+        if (empty($cids)) {
+            return [];
+        }
+        $criteria = new \CDbCriteria();
+        $criteria->select = 't.cid';
+        $criteria->join = 'INNER JOIN {{questions}} q ON q.qid = t.qid';
+        $criteria->compare('q.sid', $surveyId);

Source: LimeSurvey commit a39a01537a8f79581bd630bcac94f71ae6ce2cce

Detection Methods for CVE-2026-97685

Indicators of Compromise

Requests to /index.php/rest/*/surveys/{sid}/patch where the payload references qid or aid values that do not belong to {sid}.
Audit-log entries showing question, answer, or localization updates on surveys owned by a user other than the acting session principal.
Unexpected changes to survey conditions or translations shortly after another user authenticates and issues patch calls.

Detection Strategies

Correlate the URL survey identifier with the sid column of each targeted qid/aid in the database at write time and alert on mismatches.
Monitor LimeSurvey web-server access logs for high volumes of PATCH calls from a single authenticated account touching diverse survey IDs.
Enable and review LimeSurvey plugin-based activity logging for question and answer modifications outside expected ownership boundaries.

Monitoring Recommendations

Forward LimeSurvey application and web-server logs to a centralized SIEM for cross-user correlation.
Baseline normal patch-endpoint usage per account and alert on deviations in survey diversity or request volume.
Track the versions running in production and flag any host still reporting LimeSurvey Community Edition 7.3.0.

How to Mitigate CVE-2026-97685

Immediate Actions Required

Upgrade LimeSurvey Community Edition to a build that includes commit a39a01537a8f79581bd630bcac94f71ae6ce2cce or later.
Audit survey question, answer, and translation records for unauthorized modifications since deploying 7.3.0.
Restrict the surveys_create permission to trusted operators until patched, reducing the pool of accounts able to reach the vulnerable endpoint.

Patch Information

The upstream fix is available in the LimeSurvey repository. The commit adds ownership filtering to OpHandlerQuestionCreate via a new filterConditionIdsBySurvey() helper and routes L10n updates through QuestionService so that target objects are validated against the authorized survey ID before persistence. Review the LimeSurvey security commit and the Fluid Attacks Security Advisory for full context, and pull updates from the LimeSurvey GitHub repository.

Workarounds

Place the /rest survey-patching endpoints behind a reverse proxy that restricts access to trusted IP ranges until patched.
Temporarily disable the REST API in LimeSurvey global settings if it is not required by production workflows.
Segment tenants across separate LimeSurvey instances so that a compromised account cannot reach another tenant's qid or aid values.

bash

# Example: block the REST survey-patch endpoints at the reverse proxy
location ~* ^/index\.php/rest/.*/surveys/.*/patch {
    allow 10.0.0.0/24;   # trusted admin network
    deny  all;
}