The vulnerability (CVE-2026-50636) in LimeSurvey 7.0.0-beta1 arises from insecure handling of token-ID arrays in RemoteControl API methods invite_participants and remind_participants. These arrays are concatenated directly into a tid IN ('...') SQL clause without parameterization or input validation, allowing SQL injection. Because LimeSurvey uses PDO with emulatePrepare=true and does not disable MySQL multi-statements, attackers can execute stacked queries, enabling arbitrary SQL commands beyond the initial SELECT. This permits reading sensitive data such as administrator bcrypt password hashes, survey responses, session records, and global settings via time-based blind SQL injection techniques, as well as arbitrary writes including overwriting administrator credentials or dropping tables. The attack requires authenticated access with tokens/update permission and that the RemoteControl interface (RPCInterface = json/xml) is enabled, which is off by default.

An authenticated attacker with tokens/update permission can exploit this vulnerability to perform arbitrary SQL injection with stacked queries. This enables full read access to sensitive database contents including administrator password hashes, personally identifiable information in survey responses, session data, and global settings. The attacker can also perform destructive operations such as overwriting administrator credentials for immediate account takeover or dropping/truncating database tables. The impact affects all data accessible by the database user. The RemoteControl interface must be enabled for exploitation, limiting exposure to environments where this feature is active.

No official patch or fix is currently documented for this vulnerability. Since the RemoteControl interface must be enabled for exploitation and it is disabled by default, disabling or not enabling this interface reduces exposure. Monitor vendor advisories for updates or patches addressing this issue. Until a fix is available, restrict tokens/update permissions to trusted users only and consider disabling RemoteControl API if not required. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.