CVE-2025-13829

Incorrect Authorization vulnerability in Data Illusion Zumbrunn NGSurvey allows any logged-in user to obtain the private information of any other user.



 Critical information retrieved: 
  *  APIKEY (1 year user Session)
  *  RefreshToken (10 minutes user Session)
  *  Password hashed with bcrypt
  *  User IP
  *  Email
  *  Full Name
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
UNKNOWN
---
TCS-CERTCNA
---
---
CISA-ADPADP
---
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 11%
Common Weakness Enumeration
References
https://docs.ngsurvey.com/installation-setup/change-log#id-3.6.17-2025-05-28