---
id: "CVE-2026-129151"
page: "https://infrastack.ai/live/CVE-2026-129151"
kind: "vulnerability"
aliases: ["CVE-2026-129151"]
title: "SurveyKing: anonymous survey view leaks all responses and lookup password"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "SurveyKing", "fixed": [], "affected": "1.13.2", "ecosystem": "github"}]
ecosystems: []
tags: ["auth-bypass", "data-exposure", "package", "self-hosted", "surveyking"]
not_affected_if: ["auth-required", "non-public-surveys"]
published_at: "2026-11-13T18:17:39+00:00"
first_seen_at: "2026-11-13T18:49:30+00:00"
updated_at: "2026-11-13T18:54:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129151", "first_seen_at": "2026-11-13T18:49:30+00:00"}, {"source": "analyst", "url": "https://github.com/javahuang/SurveyKing/issues/92", "first_seen_at": "2026-11-13T18:54:43+00:00", "cites": ["https://github.com/javahuang/SurveyKing/issues/92"]}]
exploit_sources: []
---

# SurveyKing: anonymous survey view leaks all responses and lookup password

Link for people: https://infrastack.ai/live/CVE-2026-129151 (this .md is for agents)

SurveyKing 1.13.2 exposes its result lookup configuration, including the password, on the anonymous survey page, and skips the password check when no answer is sent. An attacker with a public survey link can use a wildcard in a MyBatis LIKE query to read complete survey responses, including hidden fields.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:SurveyKing affected 1.13.2 fixed no fixed version listed

## How to check

Check the SurveyKing version (1.13.2 is the version named in the advisory; other versions are not confirmed either way). Open a public survey link and look in the page source or API response for the result-lookup config and password. If surveys hold sensitive data, treat past responses as possibly exposed.

## Fix

No fixed version published as of 2026-11-13; upstream issue #92 is open. Watch the issue and the releases page.

## Timeline

- 2026-11-13T18:49:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129151
- 2026-11-13T18:54:43+00:00 analyst https://github.com/javahuang/SurveyKing/issues/92 — VulnCheck advisory lists only 1.13.2 as affected; reporter's GitHub issue #92 is open with no maintainer reply and no fix release found. Fix unknown. No exploitation or PoC link seen.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/surveyking-1.13.2-unauthenticated-survey-response-disclosure-via-result-lookup
- [mentions] SurveyKing issue #92: 4 security vulnerabilities (open) https://github.com/javahuang/SurveyKing/issues/92

## From the sources

SurveyKing 1.13.2 contains a missing authorization vulnerability in result lookup: the anonymous survey view leaks the lookup configuration, including its password, and the lookup password check is skipped when no answer is sent. Unauthenticated attackers with a public survey link can inject a % wildcard into the MyBatis LIKE condition to match all responses, then call loadProject with an answerId to read complete responses including hidden fields.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_