CVE-2026-102626 describes a vulnerability in LimeSurvey Community Edition 7.4.0 where an authenticated user with the global Surveys: create permission can inject a JavaScript-breaking value into the date_min attribute of a Date/Time question. When another user views the affected question, LimeSurvey inserts this value directly into a single-quoted inline JavaScript literal without encoding it for JavaScript context, enabling potential cross-site scripting attacks. This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

The vulnerability allows an authenticated user with specific permissions to inject malicious JavaScript code that executes in the context of other users viewing the affected survey question. This can lead to high-impact consequences such as session hijacking, privilege escalation, or other malicious actions within the LimeSurvey application. The CVSS 4.0 vector indicates high severity with network attack vector, low attack complexity, partial user interaction, and partial privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the Surveys: create permission to trusted users only and monitor for suspicious activity related to survey question creation. Avoid rendering untrusted input in JavaScript contexts without proper encoding.