CVE-2026-18403

This CVE is an authenticated SQL injection in LimeSurvey's participant token copy workflow (CPDB). The injection point sits in a data-transfer function that moves participant identifiers between survey databases. The authentication requirement is being treated as a significant mitigator, but this framing obscures the real risk: users with CPDB access already handle personally identifiable information, and the workflow itself is a data junction connecting multiple surveys. The bridge quality of this workflow is what matters most. A SQL injection in a display function lets you read data from one context. A SQL injection in a token-copy function lets you read, exfiltrate, or poison data that's transitively connected to every survey sharing participants with the target list. That's not just insider risk — it's a potential pivot point where a compromised lower-privilege account gains access to a data-transfer nexus. The CVSS downgrade for authentication assumes credentials are the hard part, but in organizations where survey admins have CPDB access and may have less security maturity than database admins, the credential may not be the expensive part of the attack chain. For defenders: verify the patch addresses parameterized queries in the token-copy function specifically. Audit other data-transfer and migration workflows in your LimeSurvey instance — junction points between surveys, bulk import/export features, participant merge operations. If the codebase shows mixed ORM and raw SQL patterns, similar issues likely exist in structurally similar workflows. The 'secondary feature' label historically correlates with lower audit frequency and lower patch priority, so treat this as a forcing function to inventory which features in your deployment have fallen out of active security review.

Reviewed through automated stages and approved by a human before publication.