LimeSurvey CVE-2026-50636

Exploitation requires that the LimeSurvey RemoteControl interface is explicitly enabled (RPCInterface set to 'json' or 'xml' in application/config/config.php), which is not the default configuration, and that the attacker holds a valid LimeSurvey account with the tokens/update permission on at least one survey whose token table can be targeted. The attacker must be able to reach the RemoteControl endpoint over the network and call invite_participants or remind_participants with a crafted $aTokenIds array. Stacked-query escalation specifically depends on the default PDO settings shipped by LimeSurvey (emulatePrepare = true) and a MySQL/MariaDB backend that has not had multi-statement support disabled - deployments on other database backends or with hardened PDO flags may still suffer single-statement injection but lose the ability to append arbitrary INSERT/UPDATE/DROP statements.

CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 8.7 and accurately reflects a network-reachable, low-complexity attack requiring only low-privilege authentication (a survey operator with the tokens/update permission) and no user interaction, yielding full confidentiality, integrity, and availability impact on the database. EPSS and CISA KEV data were not provided in the input, so probability of widespread exploitation and active-exploitation status are unconfirmed. The mitigating factor that the RemoteControl interface (RPCInterface = json/xml) is disabled by default narrows the exposed population, so this is best treated as a high-impact issue for organizations that have explicitly enabled RemoteControl - typically those automating survey/participant management - rather than a universal emergency. Tags ('SQLi', 'Oracle') and VulnCheck's advisory point to a credible time-based blind oracle technique; no public exploit identified at time of analysis.

An attacker who has obtained or been granted a low-privilege LimeSurvey account with the tokens/update permission on any survey calls the invite_participants (or remind_participants) RemoteControl method and supplies a token-ID array whose element terminates the IN-clause string and appends a second statement such as UPDATE lime_users SET password=... WHERE uid=1. Because emulated prepared statements pass the concatenated payload to MySQL as a multi-statement batch, the administrator password hash is overwritten and the attacker logs in as a global admin; alternatively, a SLEEP()-based blind oracle extracts bcrypt hashes for offline cracking. No public exploit identified at time of analysis, but the patch diff publicly identifies the exact sink.