The ability to edit groups owned by any user. in limesurvey/limesurvey
Jun 15th 2023
The edit group function does not check the owner, allowing for the possibility to modify a group without being the owner of that group.
Proof of Concept
Step 1: We have User1 who owns Group 1 and Group 2; User5 who owns Group 5.
Step 2: User1 performs an edit group action and changes the value of the
ugid parameter to the
groupId of User5.
Step 3: User1 successfully edits User5's group.
The ability to edit groups owned by any user.