CVE-2026-129153: SurveyKing 1.12.0 through 1.13.2 Authorization Bypass via Linked Survey linkSurveyId
SurveyKing 1.12.0 through 1.13.2 contains an authorization bypass in the linked survey feature that fails to verify the referenced linkSurveyId belongs to the caller's own project. Authenticated attackers can point a linked option at another user's survey so that loadLinkResult and updateLinkSurveyAnswer read, rewrite, or create responses in that survey.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
SurveyKing deployments running versions 1.12.0 through 1.13.2 are affected. Exploitation requires an authenticated attacker with the ability to configure a linked-survey option.
What does an attacker need to exploit the authorization bypass?
The attacker needs a valid authenticated account and a linkSurveyId identifying another user's survey. The vulnerable linked-survey handling does not verify that the referenced survey belongs to the attacker's project.
What actions can exploitation enable?
An attacker can cause loadLinkResult and updateLinkSurveyAnswer to access a survey owned by another user. This can allow reading, rewriting, or creating responses in that survey.