Is CVE-2026-50636 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-50636 being exploited in the wild.

How severe is CVE-2026-50636?

High severity, with a CVSS score of 8.8, published 9 June 2026.

Which products and versions are affected?

LimeSurvey <= 7.0, <= 7.0.0-beta1; limesurvey/limesurvey (Packagist) <= 7.0.0-beta1, ECOSYSTEM:introduced=0,last_affected=7.0.0-beta1.

Is there a fix for CVE-2026-50636?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-50636 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-50636?

Check whether you run LimeSurvey or limesurvey/limesurvey (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50636: LimeSurvey SQL injection in RemoteControl API participant methods

Q: Which products and versions are affected?

LimeSurvey <= 7.0, <= 7.0.0-beta1; limesurvey/limesurvey (Packagist) <= 7.0.0-beta1, ECOSYSTEM:introduced=0,last_affected=7.0.0-beta1.

Q: Is there a fix for CVE-2026-50636?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-50636 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-50636?

Check whether you run LimeSurvey or limesurvey/limesurvey (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50636 · Severity: high · CVSS 8.8 · Published 2026-06-09

LimeSurvey, a popular open-source survey platform, contains a security flaw in its remote management interface. An authenticated user with basic survey permissions can exploit this to gain full control over the database. This could lead to the theft of sensitive participant data, exposure of administrator passwords, or the complete deletion of survey records.

Technologies: LimeSurvey, limesurvey/limesurvey (Packagist). Vendors: LimeSurvey, Packagist.

Quick answers

Is CVE-2026-50636 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-50636 being exploited in the wild.
How severe is CVE-2026-50636?: High severity, with a CVSS score of 8.8, published 9 June 2026.
Which products and versions are affected?: LimeSurvey <= 7.0, <= 7.0.0-beta1; limesurvey/limesurvey (Packagist) <= 7.0.0-beta1, ECOSYSTEM:introduced=0,last_affected=7.0.0-beta1.
Is there a fix for CVE-2026-50636?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-50636 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-50636?: Check whether you run LimeSurvey or limesurvey/limesurvey (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in LimeSurvey's RemoteControl API within the invite_participants and remind_participants methods. The root cause is the lack of input validation or parameterization when passing a caller-supplied token-ID array into the TokenDynamic::findUninvited() function, which directly concatenates values into a 'tid IN' SQL clause. Because the application uses PDO with emulated prepared statements (emulatePrepare = true) and does not disable multi-statements, attackers can perform stacked queries. This allows remote, authenticated attackers with 'tokens/update' permissions to read sensitive data (like bcrypt hashes in the lime_users table) via time-based blind techniques or perform arbitrary write/delete operations. The attack requires the RemoteControl interface (JSON/XML) to be enabled.

Affected products

LimeSurvey LimeSurvey <= 7.0.0-beta1

Identifiers

CVE-2026-50636
GHSA-pr6f-87hf-hx24

Timeline

2026-06-04: other: Fix submitted via pull request 5031
2026-06-09: disclosed: Initial advisory publication
2026-06-09: advisory: GitHub Advisory GHSA-pr6f-87hf-hx24 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.