The user can put their survey in the survey groups even though this survey group is not in public mode in limesurvey/limesurvey
Valid
Reported on
Jun 28th 2023
Description
The user can put their survey in the survey groups even though this survey group is not in public mode
Proof of Concept
Step 1: The survey group SG03 isn't in public mode
Step 2: In the "Survey groups" tab, User2 (with only survey permission) only sees the survey group Default
Step 3: But when performing "Change survey group" action, User2 can see the survey group SG03 and put a survey in this group
Step 4: A survey is put in SG03 successfully
Impact
The user can put their survey in the survey groups even though this survey group is not in public mode
We are processing your report and will contact the
limesurvey
team within 24 hours.
3 months ago
We have contacted a member of the
limesurvey
team and are waiting to hear back
3 months ago
The researcher's credibility has increased: +7
The fix bounty has been dropped
This vulnerability will not receive a CVE
to join this conversation