5.1
Medium
CVE-2026-65931 LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu…
Description
LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu entry creation endpoint. An authenticated user with only the global settings:read permission can directly invoke POST /index.php/admin/menuentries/sa/create and create new survey menu entries without the expected settings:update privilege. The endpoint also allows the attacker to submit menu IDs that the normal interface and intended update workflow restrict for non-superadministrators, enabling unauthorized changes to administrative navigation records. This issue affects LimeSurvey: 7.0.5.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| LimeSurvey | 7.0.5 | No fix stated |
Other CVEs of LimeSurvey
The 27 CVEs of LimeSurvey →
CVE-2026-102626
An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys: create permission can store a…
7.2
High
CVE-2026-97685
An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an…
7.1
High
CVE-2026-92730
LimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vulnerability on the administrative…
7.4
High
CVE-2026-91775
LimeSurvey Community Edition 7.0.14 fails to safely encode attacker-controlled content from a crafted .lss survey file…
7.4
High