CVE-2026-50636 LimeSurvey RemoteControl invite_participants/remind_participants SQL Injection
Authenticated attackers can inject SQL via RemoteControl API to read sensitive data or overwrite admin credentials, requiring the non-default RemoteControl interface to be enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-50636?
CVE-2026-50636 is a high-severity SQL injection vulnerability in LimeSurvey, published on 9 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The RemoteControl API methods invite_participants and remind_participants pass a caller-supplied token-ID array into TokenDynamic::findUninvited(), which concatenates the values directly into a tid IN ('...') SQL clause without parameterization or input validation. A remote, authenticated attacker holding the tokens/update permission on a survey can inject a crafted array element to perform SQL injection. Because LimeSurvey configures its PDO connection with emulated prepared statements (emulatePrepare = true) and does not disable MySQL multi-statements, the injection supports stacked queries: the attacker can append arbitrary additional statements (INSERT/UPDATE/DELETE/DROP/CREATE) after the original SELECT. This permits both arbitrary read of any data in the database, such as administrator bcrypt password hashes (lime_users), survey response PII, session records, and global settings, all recoverable via a SLEEP() time-based blind oracle, and arbitrary write/destruction of that data, including directly overwriting the administrator password hash for immediate account takeover or dropping/truncating tables. Reads and writes extend to any schema the application's database user can access. The RemoteControl interface (RPCInterface = json/xml) must be enabled, which is not the default.
Weakness: CWE-89
Which versions are affected by CVE-2026-50636?
2 open source packages ship an affected version, including limesurvey/limesurvey.
| Package | Affected | Fixed in |
|---|---|---|
limesurvey/limesurvey Packagist | All versions to 7.0.0-beta1 | None |
limesurvey/limesurvey Packagist | All versions to 7.0.0-beta1 | None |
How do I fix CVE-2026-50636?
No fix has been published for CVE-2026-50636 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-50636 being exploited?
There is no known exploitation of CVE-2026-50636 in the wild and no public exploit code.
Sources
Also known as GHSA-pr6f-87hf-hx24.