CVE-2026-50635

{"id": "CVE-2026-50635", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50635", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-09T18:20:43.192036Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "LimeSurvey", "product": "LimeSurvey", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "7.0"}, {"status": "unaffected", "version": "7.0.1", "versionType": "custom"}], "defaultStatus": "unknown"}]}], "published": "2026-06-09T18:17:10.273", "references": [{"url": "https://github.com/LimeSurvey/LimeSurvey/pull/5032", "source": "disclosure@vulncheck.com"}, {"url": "https://www.limesurvey.org/", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/limesurvey-password-reset-host-header-injection-discloses-reset-token", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-640"}]}], "descriptions": [{"lang": "en", "value": "LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it. The optional allowedHosts allowlist that would constrain this is undefined in the default (and documented) configuration, so LSHttpRequest::checkIsAllowedHost() results in no operation. A remote, unauthenticated attacker who submits a forgotten-password request for a known account (requiring only the target's username and email) with a spoofed Host header causes LimeSurvey to email that account a reset link whose hostname is attacker-controlled while embedding the genuine validation_key. When the recipient or an automated inbound mail-security link scanner dereferences the link, the valid reset token is disclosed to the attacker, who replays it against the legitimate host's newPassword endpoint to set a new password and take over the account."}, {"lang": "es", "value": "LimeSurvey construye enlaces de restablecimiento de contrase\u00f1a de cuenta a partir del encabezado Host HTTP proporcionado por el cliente sin validarlo. La lista de permitidos opcional allowedHosts que restringir\u00eda esto no est\u00e1 definida en la configuraci\u00f3n predeterminada (y documentada), por lo que LSHttpRequest::checkIsAllowedHost() no realiza ninguna operaci\u00f3n. Un atacante remoto y no autenticado que env\u00eda una solicitud de contrase\u00f1a olvidada para una cuenta conocida (que requiere solo el nombre de usuario y el correo electr\u00f3nico del objetivo) con un encabezado Host falsificado hace que LimeSurvey env\u00ede por correo electr\u00f3nico a esa cuenta un enlace de restablecimiento cuyo nombre de host est\u00e1 controlado por el atacante, mientras incrusta la validation_key genuina. Cuando el destinatario o un esc\u00e1ner automatizado de enlaces de seguridad de correo entrante desreferencia el enlace, el token de restablecimiento v\u00e1lido se revela al atacante, quien lo reproduce contra el endpoint newPassword del host leg\u00edtimo para establecer una nueva contrase\u00f1a y tomar el control de la cuenta."}], "lastModified": "2026-07-23T08:10:00.137", "sourceIdentifier": "disclosure@vulncheck.com"}