CVE-2026-50636: LimeSurvey SQL Injection Vulnerability in RemoteControl API
Summary
CVE-2026-50636: LimeSurvey has a SQL Injection issue. Affects limesurvey/limesurvey versions < 7.0.0-beta1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LimeSurvey is an open-source online survey application that enables users to create, manage, and analyze surveys. It is widely used for academic research, market research, and feedback collection. LimeSurvey provides a RemoteControl API that allows for programmatic access to survey functionalities. However, this API has a critical vulnerability that exposes it to SQL injection attacks, potentially compromising sensitive data.
Vulnerability Detail
The vulnerability arises from the RemoteControl API methods 'invite_participants' and 'remind_participants', which accept a caller-supplied token-ID array. This array is passed directly into a SQL clause without proper parameterization or input validation. An authenticated attacker with tokens/update permission can exploit this flaw to inject malicious SQL code. The vulnerability is exacerbated by LimeSurvey's configuration of PDO connections with emulated prepared statements and the allowance of MySQL multi-statements, enabling attackers to execute arbitrary SQL commands, including data retrieval and manipulation. This could lead to unauthorized access to sensitive information, such as administrator credentials and survey responses, as well as potential data loss or corruption.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If you cannot immediately update LimeSurvey, consider disabling the RemoteControl API (RPCInterface) to mitigate the risk. This can be done by modifying the configuration settings in your LimeSurvey installation.
Conclusion
The SQL injection vulnerability in LimeSurvey's RemoteControl API poses a significant risk to users, allowing attackers to manipulate and access sensitive data. It is crucial to update to the latest version to mitigate this risk and ensure the security of your surveys and user information.
See every vulnerability recorded for limesurvey/limesurvey →
FAQ
CVE-2026-50636 is a vulnerability in LimeSurvey that allows for SQL injection through its RemoteControl API, potentially compromising sensitive data.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file.
Exploitation of this vulnerability can lead to unauthorized access to sensitive data, including administrator credentials and survey responses, as well as data loss or corruption.
Yes, updating to a version later than 7.0.0-beta1 will patch this vulnerability. Use 'composer update limesurvey/limesurvey' to update.
If immediate updating is not possible, disable the RemoteControl API to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for limesurvey/limesurvey.
