CVE-2026-65931
MediumCVSS 5.1Summary
LimeSurvey Community Edition 7.0.5 contains an improper authorization vulnerability in the survey menu entry creation endpoint. An authenticated user with only global settings:read permission can directly invoke POST /index.php/admin/menuentries/sa/create and create new survey menu entries without the expected settings:update privilege. The endpoint also allows the attacker to submit menu IDs that the normal interface restricts for non-superadministrators, enabling unauthorized changes to administrative navigation records.
Risk Assessment
The risk includes unauthorized modification of administrative navigation, which could lead to privilege escalation or manipulation of the admin interface. This may compromise system integrity and trust in survey configuration.
Recommendation
It is recommended to immediately upgrade LimeSurvey to a version that includes a fix for this vulnerability. Additionally, restrict access to the menu entry creation endpoint to authorized administrators only.
Original NVD description (English source)
LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu entry creation endpoint. An authenticated user with only the global settings:read permission can directly invoke POST /index.php/admin/menuentries/sa/create and create new survey menu entries without the expected settings:update privilege. The endpoint also allows the attacker to submit menu IDs that the normal interface and intended update workflow restrict for non-superadministrators, enabling unauthorized changes to administrative navigation records. This issue affects LimeSurvey: 7.0.5.