SQL Injection Vulnerability in LimeSurvey RemoteControl API
CVE-2026-50636

8.7HIGH

Key Information:

Vendor

Limesurvey

Status
Limesurvey
Vendor
CVE Published:
9 June 2026

What is CVE-2026-50636?

The LimeSurvey RemoteControl API contains a vulnerability where unvalidated user input can be exploited to execute arbitrary SQL commands. By manipulating token-ID arrays, an authenticated attacker can perform SQL injection through the invite_participants and remind_participants methods, leading to unauthorized access to sensitive data stored in the database. With the potential to execute stacked queries, attackers can read and modify data, including sensitive user credentials and survey responses. Proper security practices must be implemented to safeguard against this risk, particularly by ensuring that the RemoteControl interface is not unnecessarily enabled.

Affected Version(s)

LimeSurvey 0 <= 7.0

LimeSurvey 7.0.1

References

https://github.com/LimeSurvey/LimeSurvey/pull/5031
issue-tracking
https://www.limesurvey.org/
product
https://www.vulncheck.com/advisories/limesurvey-remotecon...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

McCaulay Hudson (@_McCaulay) of watchTowr
.