SURVEYKING · CVE-2026-129151 · Package
NO FIX YET · SEE WHAT TO DO
SurveyKing 1.13.2 exposes its result lookup configuration, including the password, on the anonymous survey page, and skips the password check when no answer is sent. An attacker with a public survey link can use a wildcard in a MyBatis LIKE query to read complete survey responses, including hidden fields.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted SurveyKing 1.13.2 deployments that publish survey links. Anyone with a public survey link can read all responses to that survey, including hidden fields, because the lookup password is exposed on the anonymous page and not checked when no answer is sent. Teams not running SurveyKing, or with no public or anonymous surveys, can skip it.
Not affected if auth-required, non-public-surveys
Who cares auth-bypass, data-exposure, self-hosted, surveyking
1.13.2 is the version named in the advisory; other versions are not confirmed either way)SurveyKing 1.13.2 contains a missing authorization vulnerability in result lookup: the anonymous survey view leaks the lookup configuration, including its password, and the lookup password check is skipped when no answer is sent. Unauthenticated attackers with a public survey link can inject a % wildcard into the MyBatis LIKE condition to match all responses, then call loadProject with an answerId to read complete responses including hidden fields.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.