Authentication Bypass in SurveyKing by JavaHuang
CVE-2026-129152

6.9MEDIUM

Key Information:

Vendor

Javahuang

Status
Surveyking
Vendor
CVE Published:
13 November 2026

What is CVE-2026-129152?

SurveyKing versions 1.12.0 through 1.13.2 are susceptible to an authentication bypass vulnerability. This flaw allows unauthenticated users to submit responses to protected surveys, as the AnswerServiceImpl.saveAnswer method neglects to enforce login and survey password checks. By taking advantage of this vulnerability, attackers can not only submit invalid responses but can also manipulate the data by impersonating other users. Consequently, this leads to the potential corruption of survey results, jeopardizing the integrity and reliability of the data collected.

Affected Version(s)

SurveyKing 1.12.0 <= 1.13.2

References

https://vul.yulun.ac.cn/20261107/surveyking/
third-party-advisory
https://github.com/javahuang/SurveyKing/issues/92
issue-tracking
https://github.com/javahuang/SurveyKing/blob/5de0d05b682e...
technical-description

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wu Yulun
.