SURVEYKING · CVE-2026-129152 · Package
NO FIX YET
SurveyKing versions 1.12.0 through 1.13.2 skip login and survey password checks when saving answers. An unauthenticated attacker can submit survey responses and set the createBy field to impersonate other users, corrupting survey results.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running SurveyKing 1.12.0 through 1.13.2 as a survey server, especially where some surveys require login or a password. The flaw is in the answer-saving service, so any deployment exposing that endpoint to the network is reachable. Deployments on versions outside that range, or with no protected surveys, are not affected by this description.
Not affected if default-config
Who cares self-hosted, surveyking
1.12.0 through 1.13.2No fix yet, per the sources.
SurveyKing 1.12.0 through 1.13.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to submit survey responses because AnswerServiceImpl.saveAnswer skips login-required and survey password checks. Attackers can submit responses to protected surveys and set createBy in the request body to impersonate other users, corrupting survey results.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.