---
id: "CVE-2026-129152"
page: "https://infrastack.ai/live/CVE-2026-129152"
kind: "vulnerability"
aliases: ["CVE-2026-129152"]
title: "SurveyKing: unauthenticated users can submit responses to protected surveys"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "SurveyKing", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["package", "self-hosted", "surveyking"]
not_affected_if: ["default-config"]
published_at: "2026-11-13T18:17:39+00:00"
first_seen_at: "2026-11-13T18:49:30+00:00"
updated_at: "2026-11-13T18:51:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129152", "first_seen_at": "2026-11-13T18:49:30+00:00"}]
exploit_sources: []
---

# SurveyKing: unauthenticated users can submit responses to protected surveys

Link for people: https://infrastack.ai/live/CVE-2026-129152 (this .md is for agents)

SurveyKing versions 1.12.0 through 1.13.2 skip login and survey password checks when saving answers. An unauthenticated attacker can submit survey responses and set the createBy field to impersonate other users, corrupting survey results.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SurveyKing affected range not listed fixed no fixed version listed

## How to check

- Check the installed SurveyKing version and see whether it falls in `1.12.0` through `1.13.2`
- Review whether surveys you run are protected by login or a survey password

## Timeline

- 2026-11-13T18:49:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129152

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/surveyking-1.12.0-through-1.13.2-authentication-bypass-via-saveanswer-response-submission

## From the sources

SurveyKing 1.12.0 through 1.13.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to submit survey responses because AnswerServiceImpl.saveAnswer skips login-required and survey password checks. Attackers can submit responses to protected surveys and set createBy in the request body to impersonate other users, corrupting survey results.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_