SQL Injection Vulnerability in LimeSurvey Community Edition
CVE-2026-18403

6MEDIUM

Key Information:

Vendor

Limesurvey

Status
Limesurvey
Vendor
CVE Published:
14 August 2026

What is CVE-2026-18403?

The LimeSurvey Community Edition 7.0.5 poses a significant security risk due to an authenticated SQL injection vulnerability in its Central Participant Database (CPDB) workflow. This vulnerability enables unauthorized access and manipulation of participant tokens within the central participant list, potentially compromising sensitive survey data and user privacy. It is vital for users of this version to review the vulnerability and apply necessary patches to safeguard their applications.

Affected Version(s)

LimeSurvey Windows 7.0.5

References

https://fluidattacks.com/es/advisories/rihanna
third-party-advisory
https://github.com/LimeSurvey/LimeSurvey/
product
https://github.com/LimeSurvey/LimeSurvey/commit/7735ce31c...
patch

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Miguel Gomez
Fluid Attacks' AI SAST Scanner
.