CVE-2026-129152 in SurveyKing
Summary
by MITRE • 11/13/2026
SurveyKing 1.12.0 through 1.13.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to submit survey responses because AnswerServiceImpl.saveAnswer skips login-required and survey password checks. Attackers can submit responses to protected surveys and set createBy in the request body to impersonate other users, corrupting survey results.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/13/2026
SurveyKing versions 1.12.0 through 1.13.2 are affected by a critical authentication bypass vulnerability that fundamentally undermines the integrity of data collection mechanisms within the application. The core technical flaw resides in the AnswerServiceImpl.saveAnswer method, which fails to enforce mandatory security controls before persisting user input. Specifically, this function omits checks for active session authentication and survey-specific password requirements. In a properly secured web application, any attempt to submit sensitive or protected data must first verify that the requester possesses valid credentials and appropriate permissions relative to the target resource. By skipping these validations, the software allows unauthenticated actors to interact with endpoints designed exclusively for authorized users, effectively rendering access controls inert for this specific operation.
The operational impact of this vulnerability is severe, as it permits attackers to submit survey responses without any form of prior authentication or password entry. This capability extends beyond simple data injection; because the application accepts a createBy field within the request body, malicious actors can manipulate metadata associated with each submission. By setting this parameter to an arbitrary value, such as the username of an administrator or another legitimate user, attackers can impersonate other individuals in the system records. This manipulation corrupts survey results by attributing responses to users who did not actually provide them, thereby distorting statistical outcomes and compromising the trustworthiness of any decisions based on these surveys.
From a classification perspective, this vulnerability aligns with CWE-287, which describes Improper Authentication, as the system fails to correctly verify the identity of the user attempting to perform an action. Furthermore, it relates closely to CWE-345, Insufficient Verification of Data Authenticity, because the application blindly accepts and processes a createBy field from client-side input without validating its legitimacy against established session data or database records. In terms of offensive security frameworks, this behavior is consistent with ATT&CK technique T1078, Valid Accounts, where attackers leverage valid credentials or impersonate them to gain unauthorized access, although in this specific case, the bypass allows action even without any initial credential presentation for the submission itself.
To mitigate this vulnerability, immediate patching to a version of SurveyKing that addresses these flaws is required. In the interim, if an upgrade is not immediately feasible, administrators should implement network-level controls such as Web Application Firewalls (WAF) rules that restrict access to the answer submission endpoints based on IP reputation or known malicious patterns. Additionally, input validation must be strengthened server-side to ensure that metadata fields like createBy are derived exclusively from verified session tokens rather than trusted request parameters. Regular security audits and code reviews focusing on authentication middleware integration can help prevent similar logic flaws in future development cycles.