{"id":"CVE-2026-129152","kind":"vulnerability","aliases":["CVE-2026-129152"],"related":[],"title":"SurveyKing: unauthenticated users can submit responses to protected surveys","description":"SurveyKing 1.12.0 through 1.13.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to submit survey responses because AnswerServiceImpl.saveAnswer skips login-required and survey password checks. Attackers can submit responses to protected surveys and set createBy in the request body to impersonate other users, corrupting survey results.","summary":"SurveyKing versions 1.12.0 through 1.13.2 skip login and survey password checks when saving answers. An unauthenticated attacker can submit survey responses and set the createBy field to impersonate other users, corrupting survey results.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SurveyKing","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["package","self-hosted","surveyking"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed SurveyKing version and see whether it falls in `1.12.0` through `1.13.2`\n- Review whether surveys you run are protected by login or a survey password","fix":null,"status":"open","published_at":"2026-11-13T18:17:39+00:00","first_seen_at":"2026-11-13T18:49:30+00:00","triaged_at":"2026-11-13T18:51:38+00:00","updated_at":"2026-11-13T18:51:38+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T18:51:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"SurveyKing: unauthenticated users can submit responses to protected surveys","impact":"low","summary":"SurveyKing versions 1.12.0 through 1.13.2 skip login and survey password checks when saving answers. An unauthenticated attacker can submit survey responses and set the createBy field to impersonate other users, corrupting survey results.","audience":"businesses","category":"package","nicknames":[],"who_cares":["surveyking","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attackers forge survey responses and impersonate other users","analyst_note":"Confirm the fixed version and any setting from the NVD or VulnCheck advisory before publishing a fix.","how_to_check":"- Check the installed SurveyKing version and see whether it falls in `1.12.0` through `1.13.2`\n- Review whether surveys you run are protected by login or a survey password","plain_action":"","product_name":"SurveyKing","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Teams running SurveyKing 1.12.0 through 1.13.2 as a survey server, especially where some surveys require login or a password. The flaw is in the answer-saving service, so any deployment exposing that endpoint to the network is reachable. Deployments on versions outside that range, or with no protected surveys, are not affected by this description.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000734,"input_tokens":4606,"output_tokens":547,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-129152':12A,15A '-2026':11A,14A '1.12.0':24B,56C '1.13.2':26B,58C 'allow':65C 'answer':35B 'answerserviceimpl.saveanswer':73C 'attack':38B,67C,82C 'authent':61C 'bodi':95C 'bypass':62C 'check':32B,81C 'contain':59C 'corrupt':52B,100C 'createbi':46B,91C 'cve':10A,13A 'field':47B 'host':20B 'imperson':49B,97C 'login':28B,76C 'login-requir':75C 'packag':17B 'password':31B,80C 'protect':8A,87C 'request':94C 'requir':77C 'respons':6A,42B,71C,85C 'result':54B,102C 'save':34B 'self':19B 'self-host':18B 'set':44B,90C 'skip':27B,74C 'submit':5A,40B,69C,84C 'survey':9A,30B,41B,53B,70C,79C,88C,101C 'surveyk':1A,21B,22B,55C 'surveyking':16A 'unauthent':2A,37B,66C 'user':3A,51B,99C 'version':23B 'vulner':63C","nicknames":[],"mitigations":[],"who_affected":"Teams running SurveyKing 1.12.0 through 1.13.2 as a survey server, especially where some surveys require login or a password. The flaw is in the answer-saving service, so any deployment exposing that endpoint to the network is reachable. Deployments on versions outside that range, or with no protected surveys, are not affected by this description.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["surveyking"],"ptokens":["surveyking"],"labels":["medium","package","selfhosted","surveyking","vendor"],"campaign_type":null,"search_a":"'-129152':12A,15A '-2026':11A,14A 'cve':10A,13A 'protect':8A 'respons':6A 'submit':5A 'survey':9A 'surveyk':1A 'surveyking':16A 'unauthent':2A 'user':3A","search_b":"'1.12.0':24B '1.13.2':26B 'answer':35B 'attack':38B 'check':32B 'corrupt':52B 'createbi':46B 'field':47B 'host':20B 'imperson':49B 'login':28B 'packag':17B 'password':31B 'respons':42B 'result':54B 'save':34B 'self':19B 'self-host':18B 'set':44B 'skip':27B 'submit':40B 'survey':30B,41B,53B 'surveyk':21B,22B 'unauthent':37B 'user':51B 'version':23B","search_c":"'1.12.0':56C '1.13.2':58C 'allow':65C 'answerserviceimpl.saveanswer':73C 'attack':67C,82C 'authent':61C 'bodi':95C 'bypass':62C 'check':81C 'contain':59C 'corrupt':100C 'createbi':91C 'imperson':97C 'login':76C 'login-requir':75C 'password':80C 'protect':87C 'request':94C 'requir':77C 'respons':71C,85C 'result':102C 'set':90C 'skip':74C 'submit':69C,84C 'survey':70C,79C,88C,101C 'surveyk':55C 'unauthent':66C 'user':99C 'vulner':63C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T18:17:39+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129152","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129152","severity":null,"published_at":"2026-11-13T18:17:39+00:00","modified_at":"2026-11-13T18:17:39+00:00","first_seen_at":"2026-11-13T18:49:30+00:00","fetched_at":"2026-11-13T18:49:30+00:00","note":null}],"documents":[{"id":148610,"url":"https://www.vulncheck.com/advisories/surveyking-1.12.0-through-1.13.2-authentication-bypass-via-saveanswer-response-submission","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}