LimeSurvey up to 7.0 Password Endpoint checkIsAllowedHost password recovery

Summaryinfo

A vulnerability has been found in LimeSurvey up to 7.0 and classified as critical. Affected by this issue is the function LSHttpRequest::checkIsAllowedHost of the component Password Endpoint. This manipulation causes password recovery. The identification of this vulnerability is CVE-2026-50635. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability was found in LimeSurvey up to 7.0. It has been declared as critical. Affected by this vulnerability is the function LSHttpRequest::checkIsAllowedHost of the component Password Endpoint. The manipulation with an unknown input leads to a password recovery vulnerability. The CWE definition for the vulnerability is CWE-640. The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it. The optional allowedHosts allowlist that would constrain this is undefined in the default (and documented) configuration, so LSHttpRequest::checkIsAllowedHost() results in no operation. A remote, unauthenticated attacker who submits a forgotten-password request for a known account (requiring only the target's username and email) with a spoofed Host header causes LimeSurvey to email that account a reset link whose hostname is attacker-controlled while embedding the genuine validation_key. When the recipient or an automated inbound mail-security link scanner dereferences the link, the valid reset token is disclosed to the attacker, who replays it against the legitimate host's newPassword endpoint to set a new password and take over the account.

The weakness was shared by McCaulay Hudson. It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-50635 since 06/05/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1552 according to MITRE ATT&CK.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-35769). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Survey Software

Name

• LimeSurvey

Version

• 7.0

License

• open-source

Website

• Product: https://github.com/LimeSurvey/LimeSurvey/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion