---
id: CVE-2026-97685
title: >-
  An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create
  surveys can use their own survey as an authorized context while supplying
  question or answer identifiers belonging to another user's survey
summary: >-
  An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create
  surveys can use their own survey as an authorized context while supplying
  question or answer identifiers belonging to another user's survey. The REST
  survey-patch…
severity: high
cvss: 7.1
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-639
vendor: LimeSurvey
product: LimeSurvey
affected:
  - LimeSurvey 7.3.0
published: '2026-09-29'
updated: '2026-09-29'
sourceUpdated: '2026-09-29T03:17:23.360'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97685'
references:
  - url: 'https://fluidattacks.com/es/advisories/zoo'
    label: help@fluidattacks.com
  - url: 'https://github.com/LimeSurvey/LimeSurvey/'
    label: help@fluidattacks.com
  - url: >-
      https://github.com/LimeSurvey/LimeSurvey/commit/a39a01537a8f79581bd630bcac94f71ae6ce2cce
    label: help@fluidattacks.com
tags:
  - nvd
  - cve.org
cvssSource: cna
ingestedAt: '2026-09-29T03:26:23.053Z'
---

## Overview

An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an authorized context while supplying question or answer identifiers belonging to another user's survey. The REST survey-patching endpoint checks the attacker's permission against the survey ID in the request URL, but the vulnerable persistence operations resolve the target object independently by its global qid or aid and never verify that it belongs to that authorized survey.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.