CVE-2025-13829CWE-863broken-access-control

CVE-2025-13829

published December 1, 2025

CVSS

8.6

EPSS

Percentile

21.9

In the wild

Unconfirmed

What it is

Incorrect Authorization vulnerability in Data Illusion Zumbrunn NGSurvey allows any logged-in user to obtain the private information of any other user.

Critical information retrieved:

* APIKEY (1 year user Session)

* RefreshToken (10 minutes user Session)

* Password hashed with bcrypt

* User IP

* Email

* Full Name

The record

Technical detail

CVSS: 8.6 · NONE
CVSS v4.0: Not supplied
EPSS: 0.00303 · 21.9th percentile
Weakness: CWE-863 · Incorrect Authorization
Published: 2025-12-01T21:15Z

References (1)

https://docs.ngsurvey.com/installation-setup/change-log#id-3.6.17-2025-05-28 · 64c5ae8f-7972-4697-86a0-7ada793ac795

EPSS history

Timeline

01 DEC 15:47Z
Incorrect Authorization vulnerability in Data Illusion Zumbrunn NGSurvey allows any logged-in user to obtain the private information of any other user
cvelistv5