WS-2023-0349 | Mend Vulnerability Database

Vulnerability DatabaseWS-2023-0349

WS-2023-0349

Published:May 15, 2026

Updated:May 15, 2026

Incorrect Authorization in User role in limesurvey before 6.2.11+231007.

Affected Packages

limesurvey/limesurvey (PHP):

Affected version(s) >=dev-scrutinizer-patch-3 <dev-survey-booleans3

Fix Suggestion:

Update to version dev-survey-booleans3

limesurvey/limesurvey (PHP):

Affected version(s) >=dev-dependabot/npm_and_yarn/assets/packages/adminbasics/terser-5.14.2 <dev-dependabot/npm_and_yarn/assets/packages/lstutorial/terser-5.14.2

Fix Suggestion:

Update to version dev-dependabot/npm_and_yarn/assets/packages/lstutorial/terser-5.14.2

limesurvey/limesurvey (PHP):

Affected version(s) >=4.0.0-beta <5.3.7+220328

Fix Suggestion:

Update to version 5.3.7+220328

limesurvey/limesurvey (PHP):

Affected version(s) =dev-develop-innodb <dev-display-import-errors-master

Fix Suggestion:

Update to version dev-display-import-errors-master

limesurvey/limesurvey (PHP):

Affected version(s) =dev-fix-gitignore <dev-fix-model-relations

Fix Suggestion:

Update to version dev-fix-model-relations

limesurvey/limesurvey (PHP):

Affected version(s) >=dev-dependabot/npm_and_yarn/assets/packages/questions/upload/terser-5.14.2 <dev-findfix6

Fix Suggestion:

Update to version dev-findfix6

limesurvey/limesurvey (PHP):

Affected version(s) =dev-copy-question <dev-detached

Fix Suggestion:

Update to version dev-detached

limesurvey/limesurvey (PHP):

Affected version(s) >=dev-snyk-upgrade-db5589e32a61db42524a88ad04a6eaba <6.2.11+231007

Fix Suggestion:

Update to version 6.2.11+231007

limesurvey/limesurvey (PHP):

Affected version(s) >=3.23.6+200929 <3.25.7+210113

Fix Suggestion:

Update to version 3.25.7+210113

limesurvey/limesurvey (PHP):

Affected version(s) =dev-3.x-LTS-lite <dev-clicks-test3

Fix Suggestion:

Update to version dev-clicks-test3

limesurvey/limesurvey (PHP):

Affected version(s) >=dev-dependabot/npm_and_yarn/assets/packages/questions/upload/loader-utils-2.0.3 <2.2.5

Fix Suggestion:

Update to version 2.2.5

limesurvey/limesurvey (PHP):

Affected version(s) >=5.3.27+220725 <5.6.20+230516

Fix Suggestion:

Update to version 5.6.20+230516

limesurvey/limesurvey (PHP):

Affected version(s) >=dev-relevance-import2 <dev-snyk-upgrade-8e8193a6a781d5929de6292963cd2a21

Fix Suggestion:

Update to version dev-snyk-upgrade-8e8193a6a781d5929de6292963cd2a21

limesurvey/limesurvey (PHP):

Affected version(s) >=5.6.30+230711 <5.6.41+231017

Fix Suggestion:

Update to version 5.6.41+231017

limesurvey/limesurvey (PHP):

Affected version(s) >=3.0.1+171228 <3.23.5+200923

Fix Suggestion:

Update to version 3.23.5+200923

kevinchappell/form-builder (PHP):

Affected version(s) =dev-dependabot/npm_and_yarn/terser-4.8.1 <dev-dependabot/npm_and_yarn/lodash-4.17.21

Fix Suggestion:

Update to version dev-dependabot/npm_and_yarn/lodash-4.17.21

limesurvey/limesurvey (PHP):

Affected version(s) >=2.65.2+170606 <2.73.1+171220

Fix Suggestion:

Update to version 2.73.1+171220

limesurvey/limesurvey (PHP):

Affected version(s) =dev-dev-clean-survey-model <dev-dev-feature-api-add-quota-completeCount

Fix Suggestion:

Update to version dev-dev-feature-api-add-quota-completeCount

limesurvey/limesurvey (PHP):

Affected version(s) >=dev-anonymize-tokens <dev-basic

Fix Suggestion:

Update to version dev-basic

limesurvey/limesurvey (PHP):

Affected version(s) =dev-develop <dev-develop-develop

Fix Suggestion:

Update to version dev-develop-develop

limesurvey/limesurvey (PHP):

Affected version(s) >=dev-global-settings <dev-remove-model-calls

Fix Suggestion:

Update to version dev-remove-model-calls

limesurvey/limesurvey (PHP):

Affected version(s) =dev-dependabot/npm_and_yarn/assets/packages/questions/timer/loader-utils-1.4.2 <dev-detached2

Fix Suggestion:

Update to version dev-detached2

limesurvey/limesurvey (PHP):

Affected version(s) >=dev-fix-qngroup-phpdoc <dev-fix-tests

Fix Suggestion:

Update to version dev-fix-tests

limesurvey/limesurvey (PHP):

Affected version(s) =dev-fix-theme-help <dev-fix-typo

Fix Suggestion:

Update to version dev-fix-typo

limesurvey/limesurvey (PHP):

Affected version(s) >=dev-responses-quota <dev-test-log-checks

Fix Suggestion:

Update to version dev-test-log-checks

limesurvey/limesurvey (PHP):

Affected version(s) >=dev-snyk-fix-76cf46bd82f4347fa5bd130cdd788057 <=dev-snyk-upgrade-b8f4dac44087b061e2e7d08aa4d95731

Fix Suggestion:

Update to version no_fix

limesurvey/limesurvey (PHP):

Affected version(s) >=5.3.8+220404 <5.3.26+220720

Fix Suggestion:

Update to version 5.3.26+220720

limesurvey/limesurvey (PHP):

Affected version(s) >=dev-em_quota <dev-fix-composer-license-format

Fix Suggestion:

Update to version dev-fix-composer-license-format

limesurvey/limesurvey (PHP):

Affected version(s) >=dev-tests-lchtest <dev-update-testing-dependencies

Fix Suggestion:

Update to version dev-update-testing-dependencies

limesurvey/limesurvey (PHP):

Affected version(s) >=dev-bug/18856-buildXMLFromQuery-limit <dev-bug/19550-fix-get-class-wihout-arguments

Fix Suggestion:

Update to version dev-bug/19550-fix-get-class-wihout-arguments

Related Resources (1)

https://github.com/limesurvey/limesurvey/commit/e8dc909c417be0f783db2fd905883145f1e4272f

Do you need more information?

CVSS v4

Base Score:

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Attack Requirements

NONE

Privileges Required

LOW

User Interaction

NONE

Vulnerable System Confidentiality

LOW

Vulnerable System Integrity

LOW

Vulnerable System Availability

LOW

Subsequent System Confidentiality

NONE

Subsequent System Integrity

NONE

Subsequent System Availability

NONE

CVSS v3

Base Score:

6.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

LOW

Availability

LOW