CVE-2025-13829: Data Illusion Zumbrunn Ngsurvey

High severity, CVSS 8.6. EPSS: 0.3% chance of exploitation in the next 30 days.

Incorrect Authorization vulnerability in Data Illusion Zumbrunn NGSurvey allows any logged-in user to obtain the private information of any other user. Critical information retrieved: * APIKEY (1 year user Session) * RefreshToken (10 minutes user Session) * Password hashed with bcrypt * User IP * Email * Full Name

Affected products

• Data Illusion Zumbrunn Ngsurvey: before 3.6.17 (fixed in 3.6.17)

Published 2025-12-01. Last modified 2026-09-03.