CVE-2026-129151: SurveyKing 1.13.2 Unauthenticated Survey Response Disclosure via Result Lookup
SurveyKing 1.13.2 contains a missing authorization vulnerability in result lookup: the anonymous survey view leaks the lookup configuration, including its password, and the lookup password check is skipped when no answer is sent. Unauthenticated attackers with a public survey link can inject a % wildcard into the MyBatis LIKE condition to match all responses, then call loadProject with an answerId to read complete responses including hidden fields.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
SurveyKing 1.13.2 deployments with a publicly accessible survey link are exposed. An attacker does not need an account or prior privileges.
What does an attacker need to exploit it?
The attacker needs access to a public survey link. They can obtain the lookup configuration from the anonymous survey view, use a % wildcard in the lookup flow, and then use an answerId to retrieve complete responses.
What data can be disclosed?
The issue can disclose complete survey responses, including hidden fields. The anonymous view also exposes the result-lookup configuration and its password.
Does setting a lookup password prevent exploitation?
No. The lookup password is exposed in the anonymous survey view, and the password check is skipped when no answer is supplied.