CVE-2026-65931: LimeSurvey Community Edition 7.0.5 - Improper authorization in survey menu entry creation endpoint
LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu entry creation endpoint.
An authenticated user with only the global settings:read permission can directly invoke POST /index.php/admin/menuentries/sa/create and create new survey menu entries without the expected settings:update privilege. The endpoint also allows the attacker to submit menu IDs that the normal interface and intended update workflow restrict for non-superadministrators, enabling unauthorized changes to administrative navigation records.
This issue affects LimeSurvey: 7.0.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LimeSurvey Community Editionto a version that resolves this vulnerability.Fixed in 7.0.5
Event History
Frequently Asked Questions
Which accounts are exposed to this issue?
Any authenticated LimeSurvey Community Edition 7.0.5 account that has the global settings:read permission is able to invoke the affected endpoint. The account does not need the expected settings:update privilege.
What access and request does an attacker need to exploit it?
The attacker must be authenticated and able to send a POST request to /index.php/admin/menuentries/sa/create. They can use that endpoint to create survey menu entries directly.
What is the additional impact for non-superadministrative users?
The endpoint accepts menu IDs that the normal interface and intended update workflow restrict for non-superadministrators. This can allow unauthorized changes to administrative navigation records.