Executive Summary

CVE-2026-50636 is a SQL injection vulnerability in LimeSurvey's RemoteControl API methods invite_participants and remind_participants. These methods take a user-supplied array of token IDs and directly concatenate them into an SQL query without proper input validation or parameterization. Because LimeSurvey uses PDO with emulated prepared statements and allows MySQL multi-statements, an authenticated attacker with tokens/update permission can inject malicious SQL code. This enables the attacker to execute stacked queries, allowing arbitrary reading and writing of database data.

The attacker can read sensitive data such as administrator password hashes, survey responses containing personally identifiable information (PII), session records, and global settings. They can also perform destructive actions like overwriting administrator passwords for immediate account takeover or dropping and truncating database tables. Exploitation requires the RemoteControl interface to be enabled, which is not enabled by default.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including unauthorized access and control over the LimeSurvey application database. An attacker can read sensitive information such as administrator bcrypt password hashes, survey response PII, session data, and global settings.

Additionally, the attacker can perform destructive operations such as overwriting administrator passwords to take over accounts immediately, or dropping and truncating database tables, potentially causing data loss and service disruption.

Because the attack requires authenticated access with tokens/update permission and the RemoteControl interface enabled, the risk is limited to environments where these conditions are met.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves SQL injection through the RemoteControl API methods invite_participants and remind_participants in LimeSurvey. Detection can focus on monitoring for unusual or suspicious API calls to these methods, especially those containing token-ID arrays.

Since exploitation requires authenticated access with tokens/update permission and the RemoteControl interface enabled, detection can include reviewing logs for unexpected or unauthorized usage of these API endpoints.

Specific commands or queries to detect exploitation attempts are not provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update LimeSurvey to a version that includes the fix merged on June 5, 2026, which replaces unsafe SQL concatenation with parameterized queries using Yii's addInCondition() method.

If immediate patching is not possible, consider disabling the RemoteControl interface (RPCInterface = json/xml) if it is not required, as it is not enabled by default and is necessary for exploitation.

Additionally, review and restrict permissions to ensure that only trusted users have the tokens/update permission.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an authenticated attacker to perform SQL injection that can lead to unauthorized access and manipulation of sensitive data, including survey response personally identifiable information (PII), administrator password hashes, and session records.

Since LimeSurvey is used by organizations including those in healthcare and public sectors, and it prioritizes data privacy with GDPR compliance, this vulnerability poses a significant risk to compliance with standards like GDPR and HIPAA by potentially exposing or altering protected data.

Exploitation could result in breaches of confidentiality, integrity, and availability of sensitive data, which are core requirements of these regulations.

Useful 0 Not Useful 0