---
id: "CVE-2026-129153"
page: "https://infrastack.ai/live/CVE-2026-129153"
kind: "vulnerability"
aliases: ["CVE-2026-129153"]
title: "SurveyKing: linked surveys let logged-in users read other users' survey responses"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "SurveyKing", "fixed": [], "affected": ">= 1.12.0, <= 1.13.2", "ecosystem": "vendor"}]
ecosystems: []
tags: ["authenticated", "package", "self-hosted", "surveyking"]
not_affected_if: ["auth-required", "default-config", "no-untrusted-logins", "version-below-1.12.0"]
published_at: "2026-11-13T18:17:39+00:00"
first_seen_at: "2026-11-13T18:49:30+00:00"
updated_at: "2026-11-13T18:53:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129153", "first_seen_at": "2026-11-13T18:49:30+00:00"}, {"source": "analyst", "url": "https://vul.yulun.ac.cn/20261107/surveyking/", "first_seen_at": "2026-11-13T18:53:50+00:00", "cites": ["https://vul.yulun.ac.cn/20261107/surveyking/", "https://github.com/javahuang/SurveyKing/issues/92"]}]
exploit_sources: []
---

# SurveyKing: linked surveys let logged-in users read other users' survey responses

Link for people: https://infrastack.ai/live/CVE-2026-129153 (this .md is for agents)

SurveyKing 1.12.0 through 1.13.2 does not check that a linked survey (linkSurveyId) belongs to the caller's project. A logged-in user can read, rewrite or create responses in another user's survey. No fix is published yet; no exploitation reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SurveyKing affected >= 1.12.0, <= 1.13.2 fixed no fixed version listed

## How to check

Check the SurveyKing version (admin UI or Docker image tag); 1.12.0 through 1.13.2 are affected. Only matters if users can log in and create surveys with linked-survey options (linkSurveyId). Not stated whether linked surveys are on by default.

## Fix

No fixed version published as of 2026-11-13; upstream issue #92 is open. Watch javahuang/SurveyKing releases.

## Timeline

- 2026-11-13T18:49:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129153
- 2026-11-13T18:53:50+00:00 analyst https://vul.yulun.ac.cn/20261107/surveyking/ — VulnCheck advisory + researcher report read; upstream issue #92 still open on 2026-11-12, no fixed version or release found. Default-enabled state of linked survey feature not stated by any source. Same report lists 3 other SurveyKing flaws (unauth read of all responses, login/password bypass, stored XSS) - possible sibling signals.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/surveyking-1.12.0-through-1.13.2-authorization-bypass-via-linked-survey-linksurveyid
- [describes] SurveyKing Vulnerability Report (Wu Yulun) https://vul.yulun.ac.cn/20261107/surveyking/
- [mentions] SurveyKing issue #92: 4 security vulnerabilities (open) https://github.com/javahuang/SurveyKing/issues/92

## From the sources

SurveyKing 1.12.0 through 1.13.2 contains an authorization bypass in the linked survey feature that fails to verify the referenced linkSurveyId belongs to the caller's own project. Authenticated attackers can point a linked option at another user's survey so that loadLinkResult and updateLinkSurveyAnswer read, rewrite, or create responses in that survey.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_