# CVE-2026-50636: LimeSurvey SQL injection in RemoteControl API participant methods

Source: https://junglewise.ai/threats/cve-2026-50636-limesurvey-sql-injection-in-remotecontrol-api-participant-methods  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-09. Updated: 2026-07-31  
License: CC BY 4.0 with a link back

CVE-2026-50636 · Severity: high · CVSS 8.8 · Published 2026-06-09

LimeSurvey, a popular open-source survey platform, contains a security flaw in its remote management interface. An authenticated user with basic survey permissions can exploit this to gain full control over the database. This could lead to the theft of sensitive participant data, exposure of administrator passwords, or the complete deletion of survey records.

Technologies: [LimeSurvey](https://junglewise.ai/threats/technologies/limesurvey), [limesurvey/limesurvey (Packagist)](https://junglewise.ai/threats/technologies/limesurvey-limesurvey). Vendors: [LimeSurvey](https://junglewise.ai/threats/vendors/limesurvey), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-50636 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50636 being exploited in the wild.

**How severe is CVE-2026-50636?** High severity, with a CVSS score of 8.8, published 9 June 2026.

**Which products and versions are affected?** LimeSurvey <= 7.0, <= 7.0.0-beta1; limesurvey/limesurvey (Packagist) <= 7.0.0-beta1, ECOSYSTEM:introduced=0,last_affected=7.0.0-beta1.

**Is there a fix for CVE-2026-50636?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-50636 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-50636?** Check whether you run LimeSurvey or limesurvey/limesurvey (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in LimeSurvey's RemoteControl API within the invite_participants and remind_participants methods. The root cause is the lack of input validation or parameterization when passing a caller-supplied token-ID array into the TokenDynamic::findUninvited() function, which directly concatenates values into a 'tid IN' SQL clause. Because the application uses PDO with emulated prepared statements (emulatePrepare = true) and does not disable multi-statements, attackers can perform stacked queries. This allows remote, authenticated attackers with 'tokens/update' permissions to read sensitive data (like bcrypt hashes in the lime_users table) via time-based blind techniques or perform arbitrary write/delete operations. The attack requires the RemoteControl interface (JSON/XML) to be enabled.

## Affected products

- LimeSurvey LimeSurvey <= 7.0.0-beta1

## Identifiers

- CVE-2026-50636
- GHSA-pr6f-87hf-hx24

## Timeline

- 2026-06-04: other: Fix submitted via pull request 5031
- 2026-06-09: disclosed: Initial advisory publication
- 2026-06-09: advisory: GitHub Advisory GHSA-pr6f-87hf-hx24 published

## References

- [https://github.com/LimeSurvey/LimeSurvey/pull/5031](https://github.com/LimeSurvey/LimeSurvey/pull/5031)
- [https://www.limesurvey.org/](https://www.limesurvey.org/)
- [https://www.vulncheck.com/advisories/limesurvey-remotecontrol-invite-participants-remind-participants-sql-injection](https://www.vulncheck.com/advisories/limesurvey-remotecontrol-invite-participants-remind-participants-sql-injection)
- [https://github.com/LimeSurvey/LimeSurvey/commit/4f383aa0bbe711f0064b319edb19fba759c50a33](https://github.com/LimeSurvey/LimeSurvey/commit/4f383aa0bbe711f0064b319edb19fba759c50a33)
- [https://github.com/LimeSurvey/LimeSurvey/commit/98cfee55df97f9c82a72cf352bb204d51e588f7e](https://github.com/LimeSurvey/LimeSurvey/commit/98cfee55df97f9c82a72cf352bb204d51e588f7e)

## Related threats

- [LimeSurvey SSRF in REST API survey template endpoint](https://junglewise.ai/threats/cve-2026-63107-limesurvey-ssrf-in-rest-api-survey-template-endpoint)
- [LimeSurvey host header injection in password reset](https://junglewise.ai/threats/cve-2026-50635-limesurvey-host-header-injection-in-password-reset)
- [Cross Site Scripting vulnerability in Limesurvey v.6.15.20+251021 allows a remote attacker to execute arbitrary code…](https://junglewise.ai/threats/cve-2025-70797-cross-site-scripting-vulnerability-in-limesurvey-v-6-15-20-251021)
- [A Reflected Cross-Site Scripting (XSS) affects LimeSurvey versions prior to 6.15.11+250909, due to the lack of…](https://junglewise.ai/threats/cve-2025-63238-a-reflected-cross-site-scripting-xss-affects-limesurvey-versions)
- [LimeSurvey unsafe deserialization remote code execution](https://junglewise.ai/threats/cve-2025-56422-limesurvey-unsafe-deserialization-remote-code-execution)