PT-2025-48486 · Data Illusion · Zumbrunn Ngsurvey

Thomas Clair · Published 2025-12-01 · Updated 2025-12-01 · CVE-2025-13829

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/AU:Y

Name of the Vulnerable Software and Affected Versions Data Illusion Zumbrunn NGSurvey (affected versions not specified)

Description An incorrect authorization issue exists in Data Illusion Zumbrunn NGSurvey, allowing any authenticated user to access the private information of other users. This includes sensitive data such as the APIKEY (valid for a one-year user session), RefreshToken (valid for a ten-minute user session), Password hashed with bcrypt, User IP, Email, and Full Name. The issue involves unauthorized access to user data through improper authorization checks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-13829

Affected Products

Zumbrunn Ngsurvey

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-13829 · Security Note
• https://docs.ngsurvey.com/installation-setup/change-log#id-3.6.17-2025-05-28 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1995604512455655758 · Twitter Post
• https://twitter.com/CVEnew/status/1995522255334564025 · Twitter Post