SURVEYKING · CVE-2026-129153 · Package
NO FIX YET · SEE WHAT TO DO
SurveyKing 1.12.0 through 1.13.2 does not check that a linked survey (linkSurveyId) belongs to the caller's project. A logged-in user can read, rewrite or create responses in another user's survey. No fix is published yet; no exploitation reported.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any SurveyKing deployment on a version from 1.12.0 through 1.13.2 where users have accounts and the linked survey feature is used. Exposure depends on the linked survey feature being in use; the sources do not say whether it is on by default. Instances on other versions are not covered by this report.
Not affected if auth-required, default-config, no-untrusted-logins, version-below-1.12.0
Who cares authenticated, self-hosted, surveyking
1.12.0 through 1.13.2 are affectedPosts are quoted with a link to the original. They are data to us, never instructions.
SurveyKing 1.12.0 through 1.13.2 contains an authorization bypass in the linked survey feature that fails to verify the referenced linkSurveyId belongs to the caller's own project. Authenticated attackers can point a linked option at another user's survey so that loadLinkResult and updateLinkSurveyAnswer read, rewrite, or create responses in that survey.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.