CVE-2026-129151 in SurveyKing
Summary
by MITRE • 11/13/2026
SurveyKing 1.13.2 contains a missing authorization vulnerability in result lookup: the anonymous survey view leaks the lookup configuration, including its password, and the lookup password check is skipped when no answer is sent. Unauthenticated attackers with a public survey link can inject a % wildcard into the MyBatis LIKE condition to match all responses, then call loadProject with an answerId to read complete responses including hidden fields.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/13/2026
SurveyKing version 1.13.2 suffers from critical access control failures that expose sensitive survey data and configuration details to unauthenticated actors. The vulnerability stems primarily from a missing authorization check in the result lookup functionality, which allows anonymous users with knowledge of a public survey link to bypass intended security boundaries. Specifically, the application leaks the internal lookup configuration during the view process, including the password required for restricted lookups. This exposure occurs because the system fails to enforce authentication or proper access validation before transmitting sensitive metadata to the client side, effectively handing attackers the keys needed to interact with protected data endpoints without valid credentials.
The technical flaw is compounded by a logic error in how lookup passwords are validated. The application skips the password verification step when no answer payload is sent during the request process. This oversight allows an attacker to bypass authentication mechanisms entirely by omitting expected parameters, thereby gaining unauthorized access to restricted survey results. Once this initial barrier is lowered, attackers can exploit SQL injection techniques within the MyBatis framework used for database queries. By injecting a percent wildcard character into LIKE conditions, adversaries can manipulate query logic to match all available records rather than filtering for specific entries. This technique effectively neutralizes any intended data isolation or pagination controls that rely on pattern matching.
The operational impact of these vulnerabilities is severe, as it enables the complete exfiltration of survey responses including hidden fields that are typically concealed from general viewers. An unauthenticated attacker can iterate through answer identifiers to retrieve full response datasets, compromising respondent privacy and potentially exposing personally identifiable information or sensitive organizational data stored within surveys. This level of access violates fundamental principles of confidentiality and integrity, as it allows for the mass extraction of user-generated content without any form of consent or authorization. The ability to read hidden fields further exacerbates the risk, as these areas often contain metadata or secondary answers that respondents intended to keep private during submission but are now fully accessible via API manipulation.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control and CWE-798 Use of Hard-coded Credentials if static keys were involved, though the primary issue is the lack of enforcement rather than hardcoded secrets. The exploitation path involving SQL injection through parameterized query misuse relates to CWE-89 SQL Injection, specifically within ORM frameworks where dynamic string construction occurs despite intended safety measures. In terms of adversary tactics, this behavior maps to ATT&CK technique T1078 Valid Accounts if the leaked configuration were used for further access, but more directly reflects T1530 Data from Cloud Storage or Object Storage due to the nature of survey data hosting and retrieval via web APIs. The lack of input validation on wildcard injection also touches upon CWE-20 Improper Input Validation.
Mitigation strategies must address both the authentication bypass and the SQL injection vectors immediately. Developers should enforce strict authorization checks at every endpoint that serves sensitive configuration or result data, ensuring that anonymous users cannot access lookup configurations regardless of whether they provide answer payloads. The password verification logic must be corrected to always require valid credentials before processing any request related to restricted surveys. Additionally, input sanitization and parameterized query best practices must be applied rigorously within the MyBatis layer to prevent wildcard injection from altering query semantics. Using prepared statements with explicit type binding rather than string concatenation for LIKE clauses will neutralize the SQL injection vector. Regular security audits and penetration testing focused on access control flows are recommended to identify similar gaps in other modules of the SurveyKing application before they can be exploited by malicious actors seeking sensitive data.