Data Illusion Zumbrunn ngSurvey Incorrect Authorization Vulnerability Allowing Unauthorized Access to User Private Information

A vulnerability allowing incorrect authorization has been identified in Data Illusion Zumbrunn ngSurvey. This issue enables any logged-in user to access the private information of other users. The critical information that can be retrieved includes the API key (valid for one year), refresh token (valid for ten minutes), password hashed with bcrypt, user IP address, email, and full name.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive user information, including session tokens, hashed passwords, and personal details such as email and full name.