{"id":"CVE-2026-129151","kind":"vulnerability","aliases":["CVE-2026-129151"],"related":[],"title":"SurveyKing: anonymous survey view leaks all responses and lookup password","description":"SurveyKing 1.13.2 contains a missing authorization vulnerability in result lookup: the anonymous survey view leaks the lookup configuration, including its password, and the lookup password check is skipped when no answer is sent. Unauthenticated attackers with a public survey link can inject a % wildcard into the MyBatis LIKE condition to match all responses, then call loadProject with an answerId to read complete responses including hidden fields.","summary":"SurveyKing 1.13.2 exposes its result lookup configuration, including the password, on the anonymous survey page, and skips the password check when no answer is sent. An attacker with a public survey link can use a wildcard in a MyBatis LIKE query to read complete survey responses, including hidden fields.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SurveyKing","fixed":[],"affected":"1.13.2","ecosystem":"github"}],"ecosystems":[],"tags":["auth-bypass","data-exposure","package","self-hosted","surveyking"],"not_affected_if":["auth-required","non-public-surveys"],"how_to_check":"Check the SurveyKing version (1.13.2 is the version named in the advisory; other versions are not confirmed either way). Open a public survey link and look in the page source or API response for the result-lookup config and password. If surveys hold sensitive data, treat past responses as possibly exposed.","fix":"No fixed version published as of 2026-11-13; upstream issue #92 is open. Watch the issue and the releases page.","status":"open","published_at":"2026-11-13T18:17:39+00:00","first_seen_at":"2026-11-13T18:49:30+00:00","triaged_at":"2026-11-13T18:51:22+00:00","updated_at":"2026-11-13T18:54:43+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T18:51:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"SurveyKing: anonymous survey view leaks all responses and lookup password","impact":"high","summary":"SurveyKing 1.13.2 exposes its result lookup configuration, including the password, on the anonymous survey page, and skips the password check when no answer is sent. An attacker with a public survey link can use a wildcard in a MyBatis LIKE query to read complete survey responses, including hidden fields.","audience":"businesses","category":"package","nicknames":[],"who_cares":["surveyking","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated attacker reads complete survey responses, hidden fields","analyst_note":"Confirm the fixed version and any configuration workaround from the NVD entry or the VulnCheck advisory (www.vulncheck.com).","how_to_check":"- Check the SurveyKing version in the deployed project or package manifest, for example `1.13.2`\n- Open a public survey link in a browser and look for lookup configuration or password fields in the page source","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["auth-required","non-public-surveys"],"who_is_affected":"Teams that run SurveyKing 1.13.2 with public survey links are exposed, since the anonymous survey view is reachable without login. Installations that do not expose survey links publicly, or that run a different version, are not described as affected by the sources. The sources do not name a fixed version.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000739,"input_tokens":4622,"output_tokens":553,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and any configuration workaround from the NVD entry or the VulnCheck advisory (www.vulncheck.com).","search":"'-129151':13A,16A '-2026':12A,15A '1.13.2':30B,79C 'anonym':2A,41B,89C 'answer':51B,108C 'answerid':136C 'attack':55B,112C 'auth':19B 'auth-bypass':18B 'author':83C 'bypass':20B 'call':132C 'check':48B,103C 'complet':72B,139C 'condit':126C 'configur':35B,95C 'contain':80C 'cve':11A,14A 'data':22B 'data-exposur':21B 'expos':31B 'exposur':23B 'field':77B,143C 'hidden':76B,142C 'host':27B 'includ':36B,75B,96C,141C 'inject':119C 'leak':5A,92C 'like':68B,125C 'link':60B,117C 'loadproject':133C 'lookup':9A,34B,87C,94C,101C 'match':128C 'miss':82C 'mybati':67B,124C 'packag':24B 'page':43B 'password':10A,38B,47B,98C,102C 'public':58B,115C 'queri':69B 'read':71B,138C 'respons':7A,74B,130C,140C 'result':33B,86C 'self':26B 'self-host':25B 'sent':53B,110C 'skip':45B,105C 'survey':3A,42B,59B,73B,90C,116C 'surveyk':1A,28B,29B,78C 'surveyking':17A 'unauthent':111C 'use':62B 'view':4A,91C 'vulner':84C 'wildcard':64B,121C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted SurveyKing 1.13.2 deployments that publish survey links. Anyone with a public survey link can read all responses to that survey, including hidden fields, because the lookup password is exposed on the anonymous page and not checked when no answer is sent. Teams not running SurveyKing, or with no public or anonymous surveys, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["surveyking"],"ptokens":["surveyking"],"labels":["authbypass","dataexposure","high","package","selfhosted","surveyking"],"campaign_type":null,"search_a":"'-129151':13A,16A '-2026':12A,15A 'anonym':2A 'cve':11A,14A 'leak':5A 'lookup':9A 'password':10A 'respons':7A 'survey':3A 'surveyk':1A 'surveyking':17A 'view':4A","search_b":"'1.13.2':30B 'anonym':41B 'answer':51B 'attack':55B 'auth':19B 'auth-bypass':18B 'bypass':20B 'check':48B 'complet':72B 'configur':35B 'data':22B 'data-exposur':21B 'expos':31B 'exposur':23B 'field':77B 'hidden':76B 'host':27B 'includ':36B,75B 'like':68B 'link':60B 'lookup':34B 'mybati':67B 'packag':24B 'page':43B 'password':38B,47B 'public':58B 'queri':69B 'read':71B 'respons':74B 'result':33B 'self':26B 'self-host':25B 'sent':53B 'skip':45B 'survey':42B,59B,73B 'surveyk':28B,29B 'use':62B 'wildcard':64B","search_c":"'1.13.2':79C 'anonym':89C 'answer':108C 'answerid':136C 'attack':112C 'author':83C 'call':132C 'check':103C 'complet':139C 'condit':126C 'configur':95C 'contain':80C 'field':143C 'hidden':142C 'includ':96C,141C 'inject':119C 'leak':92C 'like':125C 'link':117C 'loadproject':133C 'lookup':87C,94C,101C 'match':128C 'miss':82C 'mybati':124C 'password':98C,102C 'public':115C 'read':138C 'respons':130C,140C 'result':86C 'sent':110C 'skip':105C 'survey':90C,116C 'surveyk':78C 'unauthent':111C 'view':91C 'vulner':84C 'wildcard':121C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T18:17:39+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129151","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129151","severity":null,"published_at":"2026-11-13T18:17:39+00:00","modified_at":"2026-11-13T18:17:39+00:00","first_seen_at":"2026-11-13T18:49:30+00:00","fetched_at":"2026-11-13T18:49:30+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-129151:3924","url":"https://github.com/javahuang/SurveyKing/issues/92","severity":null,"published_at":"2026-11-13T18:54:43+00:00","modified_at":"2026-11-13T18:54:43+00:00","first_seen_at":"2026-11-13T18:54:43+00:00","fetched_at":"2026-11-13T18:54:43+00:00","note":"VulnCheck advisory lists only 1.13.2 as affected; reporter's GitHub issue #92 is open with no maintainer reply and no fix release found. Fix unknown. No exploitation or PoC link seen.","cites":["https://github.com/javahuang/SurveyKing/issues/92"]}],"documents":[{"id":148609,"url":"https://www.vulncheck.com/advisories/surveyking-1.13.2-unauthenticated-survey-response-disclosure-via-result-lookup","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":148662,"url":"https://github.com/javahuang/SurveyKing/issues/92","title":"SurveyKing issue #92: 4 security vulnerabilities (open)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}