Executive brief
ngSurvey is a survey and form management platform. This vulnerability allows any user with a valid login account to access sensitive private information of other users—including authentication tokens, email addresses, full names, IP addresses, and password hashes—by exploiting insufficient access controls. An attacker with a basic account can escalate to full unauthorized access of other users' personal and session data.
Technical details
This is an incorrect authorization (broken access control) vulnerability in the ngSurvey data access layer. Any authenticated user can retrieve sensitive user account data belonging to other users via API or application endpoints, likely due to missing or inadequate permission checks on user data endpoints. The vulnerability exposes APIKEY tokens (valid for 1 year), RefreshToken values, bcrypt-hashed passwords, user IP addresses, email addresses, and full names. No special privileges, complex exploit chain, or user interaction is required—an attacker simply needs valid login credentials and network access to the application. A patch status has not been confirmed in available documentation.
Affected products
- Data Illusion ngSurvey <UNKNOWN>
Timeline
- 2025-12-01: disclosed