CVE-2026-129153

CVSS 7.1 (high) · published 2026-11-13

SurveyKing 1.12.0 through 1.13.2 contains an authorization bypass in the linked survey feature that fails to verify the referenced linkSurveyId belongs to the caller's own project. Authenticated attackers can point a linked option at another user's survey so that loadLinkResult and updateLinkSurveyAnswer read, rewrite, or create responses in that survey.

Weakness: CWE-639

Source: NVD CVE-2026-129153

References

• https://github.com/javahuang/SurveyKing/blob/5de0d05b682ee34244c0b6c07be24eb6358cd8a5/server/rdbms/src/main/java/cn/surveyking/server/impl/AnswerServiceImpl.java#L793-L830
• https://github.com/javahuang/SurveyKing/blob/5de0d05b682ee34244c0b6c07be24eb6358cd8a5/server/rdbms/src/main/java/cn/surveyking/server/impl/SurveyServiceImpl.java#L435-L470
• https://github.com/javahuang/SurveyKing/issues/92
• https://vul.yulun.ac.cn/20261107/surveyking/
• https://www.vulncheck.com/advisories/surveyking-1.12.0-through-1.13.2-authorization-bypass-via-linked-survey-linksurveyid

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.